The question: “A company's IT security system flags an HRIS administrator for downloading a massive volume of unencrypted executive compensation files to a personal external drive at 2:00 AM. The HR Director is notified and must address both the data privacy threat and the employee's potential misconduct. What is the MOST appropriate immediate action for the HR Director to take?”

The answer that feels right: “Terminate the administrator immediately for gross misconduct to prevent any further data exfiltration.”

The answer that scores: “Coordinate with IT to activate the Incident Response Plan (IRP) and forensically quarantine the user's access before conducting an investigatory interview.”

The trap: firing the employee feels decisive and protective. But it alerts them before access is locked and puts the evidence at risk. The exam wants quiet containment first, then the investigation.

Which environmental scanning tool is specifically designed to evaluate macroeconomic, technological, and legal factors that may impact an organization's long-term strategic plan?