An enterprise discovers that a widely used third-party monitoring agent embedded in multiple production servers has begun making undocumented outbound connections to an IP range controlled by a subcontractor the enterprise has never engaged. The agent is critical for operational visibility, and disabling it would blind several detection controls. No malicious activity has been confirmed, but threat intelligence reports suggest recent supply chain compromises involving similar agents. What should the security manager do FIRST? A. Immediately isolate all hosts running the agent from the network B. Conduct a rapid supplier risk reassessment and verify the legitimacy of the subcontractor relationship C. Disable the agent across production to eliminate potential exfiltration D. Escalate directly to regulators due to potential third-party data exposure

During a quarterly access review, an organization discovers that several DevOps engineers have accumulated multiple privileged roles across different cloud environments due to automated provisioning workflows that never revoked old permissions. No misuse has been detected, but the roles collectively exceed least-privilege requirements and present a potential lateral-movement risk. What should the security manager do FIRST? A. Immediately disable all excessive roles and force users to request access again B. Conduct a risk analysis to understand business impact before removing permissions C. Implement just-in-time privileged access to eliminate standing permissions D. Escalate the issue to HR for potential policy violations

A large financial services company is updating its security testing program. The red team reports that modern AI-driven attack tools can automatically craft polymorphic payloads, evade signature-based controls, and generate targeted spear-phishing content indistinguishable from human-written messages.The CISO wants to ensure that the organization’s security testing program can accurately measure resilience against these new capabilities. Which testing approach MOST effectively validates the organization’s defenses against AI-augmented attack techniques? A. Perform quarterly vulnerability scans using updated threat signatures and CVE databases. B. Conduct adversarial machine learning (AML) evaluations to measure susceptibility to model poisoning and evasion attacks. C. Integrate AI-enabled BAS (Breach and Attack Simulation) tools that continuously replicate evolving attacker TTPs across email, endpoint, and network layers. D. Run annual red-team exercises focused on social engineering and spear-phishing campaigns executed manually by trained personnel.

A regional bank adopts a new third-party transaction-scoring engine hosted in the cloud. The vendor refuses to provide detailed architectural diagrams but offers recent SOC 2 Type II reports. Executives want rapid deployment, but regulators recently flagged the bank for weak vendor oversight. What is the MOST appropriate next step? A. Require the vendor to provide full network diagrams before integration B. Review and validate the SOC 2 report against the bank’s control objectives C. Conduct a full on-site audit of the vendor’s operations D. Delay onboarding until regulators approve the vendor’s environment

Rymar Tech’s SOC deploys a new AI-based anomaly detection system that suddenly begins generating an unusually high volume of high-risk alerts after being retrained with third-party data the previous night. No malicious activity has been confirmed, but the alert surge is overwhelming SOC analysts and impacting monitoring effectiveness. What should the incident response manager do FIRST? A. Disable the AI platform and revert to manual triage B. Escalate to the CISO and declare a security incident C. Initiate the incident response process beginning with detection and verification D. Conduct a model validation review with the third-party integrator