A law firm signed a contract for an offshore vendor to label 50,000 client documents for AI training, starting Monday. The documents are classified Confidential and the handling standard bars external transfer. What should the security manager do FIRST? A. Require the vendor to sign a confidentiality agreement B. Have the data owner rule on reclassification or a documented exception C. Redact client identifiers before any transfer D. Encrypt the transfer and the vendor's storage (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A SaaS firm's largest customer requires an independent penetration test before renewing in 30 days. The CTO wants the in-house red team to do it, and sales wants only the customer portal tested. What should the security manager do FIRST? A. Have the in-house red team test now to hit the deadline B. Agree scope and independence criteria with the customer C. Hire an external firm to test only the customer portal D. Run a vulnerability scan before any penetration test (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A logistics firm's developers source a third of new code, including payment logic shipping in two weeks, from an AI coding assistant. The coding standard and review gates never mention assistant output. What should the security manager do FIRST? A. Run static analysis on the AI-written code B. Suspend the assistant pending vendor security review C. Extend the coding standard and review gates to assistant output D. Require developers to tag every assistant-written change (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!