A hospital audit finds nurses who moved to billing still hold clinical record access. HR never tells IT about role changes, and the CIO wants an identity governance platform bought this quarter. What should the security manager do FIRST? A. Buy the identity governance platform to automate access reviews B. Revoke clinical access from all billing staff today C. Define a mover process with HR as the authoritative source D. Recertify every department's access in a one-time review (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A university's new CISO inherits a security policy last approved six years ago. The board has funded zero trust this year, but nobody has stated how much cyber risk the institution accepts. What should the CISO do FIRST? A. Design the zero trust architecture with this year's funding B. Have the board approve a risk appetite statement C. Rewrite the policy to mandate zero trust controls D. Assess current controls against a recognised framework (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A regional bank's outsourced SOC closes most alerts as false positives, and analysts now mute noisy rules to hit response targets before a regulator exam next month. What should the security operations manager do FIRST? A. Tune the noisy rules to cut false positives B. Assess which muted rules covered risks the bank must detect C. Add analyst headcount to meet targets without muting D. Reinstate every muted rule before the exam (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

After a ransomware scare, a manufacturer's board funded zero trust. The network team wants an access broker deployed this quarter, but no inventory of applications, data flows or trust boundaries exists. What should the security manager do FIRST? A. Deploy the access broker for remote users first B. Map the applications, data flows and trust boundaries C. Segment the network by department before the rollout D. Pilot the access broker on executive devices (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A logistics firm's developers source a third of new code, including payment logic shipping in two weeks, from an AI coding assistant. The coding standard and review gates never mention assistant output. What should the security manager do FIRST? A. Run static analysis on the AI-written code B. Suspend the assistant pending vendor security review C. Extend the coding standard and review gates to assistant output D. Require developers to tag every assistant-written change (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!