A fintech's developers wrote their own encryption for a payments service launching in three weeks. It passed unit tests, and no cryptographic standard exists. What should the security architect do FIRST? A. Replace the custom code with a vetted cryptographic library B. Set a cryptographic standard and assess the design against it C. Commission a penetration test before launch D. Approve launch with a rewrite planned next quarter (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A developer commits API credentials into a public repository and immediately deletes the commit. The security team discovers the credentials are still visible in the repository's commit history. The API provides read access to customer records. What should you do FIRST? A. Purge the commit history to remove the exposed credentials from the repository B. Revoke and rotate the compromised API credentials immediately C. Scan customer records for evidence of unauthorized access using the exposed keys D. Implement pre-commit hooks to prevent future credential exposure in repositories Come back for the answer tomorrow, or study more now!