Leadership orders a penetration test of a customer-facing platform after a competitor's breach. Half the platform runs on a SaaS provider's infrastructure. The testing firm is contracted and ready to begin. What should the security manager confirm FIRST? A. Authorization and scope boundaries from the SaaS provider B. Rules of engagement defining escalation and stop conditions C. Backups of production data before intrusive testing begins D. Cyber liability coverage extends to testing activities (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A new CISO inherits a mature control environment but finds no documented risk assessments supporting it. Leadership considers the controls sufficient and resists spending on analysis. What should the CISO do FIRST? A. Conduct a risk assessment to align controls with business risk B. Benchmark the control set against an industry framework C. Present leadership a business case for the assessment budget D. Continue operations while documenting controls retroactively (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

An autonomous AI agent needs credentials to query production databases and invoke internal APIs on a recurring schedule. The automation team proposes reusing a departed developer's service account to launch quickly. What should the IAM manager require FIRST? A. Rotate the credentials and transfer the account to the automation team B. Register the agent as a distinct non-human identity with a defined owner C. Scope the account's permissions to only the required datasets D. Enable enhanced logging on all agent-initiated transactions (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

During active ransomware containment, the operations team wants to immediately wipe and reimage infected servers to restore a critical service. Cyber insurance and law enforcement notifications are pending. What should the incident commander do FIRST? A. Preserve forensic images of affected systems before restoration B. Restore the service from the most recent clean backup C. Notify the cyber insurer to avoid violating policy conditions D. Isolate remaining unaffected segments to prevent spread (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

Welcome to the group! Please share what you hope to gain from being here, and for fun, tell us the best piece of advice you've ever received!