A SaaS firm's largest customer requires an independent penetration test before renewing in 30 days. The CTO wants the in-house red team to do it, and sales wants only the customer portal tested. What should the security manager do FIRST? A. Have the in-house red team test now to hit the deadline B. Agree scope and independence criteria with the customer C. Hire an external firm to test only the customer portal D. Run a vulnerability scan before any penetration test (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A hospital audit finds nurses who moved to billing still hold clinical record access. HR never tells IT about role changes, and the CIO wants an identity governance platform bought this quarter. What should the security manager do FIRST? A. Buy the identity governance platform to automate access reviews B. Revoke clinical access from all billing staff today C. Define a mover process with HR as the authoritative source D. Recertify every department's access in a one-time review (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A university's new CISO inherits a security policy last approved six years ago. The board has funded zero trust this year, but nobody has stated how much cyber risk the institution accepts. What should the CISO do FIRST? A. Design the zero trust architecture with this year's funding B. Have the board approve a risk appetite statement C. Rewrite the policy to mandate zero trust controls D. Assess current controls against a recognised framework (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A regional bank's outsourced SOC closes most alerts as false positives, and analysts now mute noisy rules to hit response targets before a regulator exam next month. What should the security operations manager do FIRST? A. Tune the noisy rules to cut false positives B. Assess which muted rules covered risks the bank must detect C. Add analyst headcount to meet targets without muting D. Reinstate every muted rule before the exam (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

After a ransomware scare, a manufacturer's board funded zero trust. The network team wants an access broker deployed this quarter, but no inventory of applications, data flows or trust boundaries exists. What should the security manager do FIRST? A. Deploy the access broker for remote users first B. Map the applications, data flows and trust boundaries C. Segment the network by department before the rollout D. Pilot the access broker on executive devices (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!