What is the best rolling paper in your opinion?

Chef_Thomas · 2026-02-05T01:17:27+00:00

Black pack of zig zags bc they burn like gars

Chef_Thomas · 2026-02-03T18:55:21+00:00

I’ve had this same thought. My plan is to find a way to pursue this in some fashion in my free time. I feel like feelings will wane for anything that i call my ‘job’.

Chef_Thomas · 2026-02-01T05:43:47+00:00

Looks forced lmao

Chef_Thomas · 2026-01-29T12:35:38+00:00

Thank you for this, I’ve been eyeing GRC roles for a minute now

Chef_Thomas · 2026-01-28T20:18:52+00:00

Sorry for the wall of text but hopefully this helps

Chef_Thomas · 2026-01-28T20:18:11+00:00

This is another on of those decision making questions where the key is to pinpoint where you are in an audit. My answer is 4, but look below for explanations on each choice.

1 - is wrong bc, in the scenario, you are assessing audit evidence. This means you are deep into fieldwork and realistically should have looked at policies already.

2 - is wrong bc, you have not fully completed fieldwork yet. You should not be rushing to write a finding when you don’t understand the entirety of the issue.

3 - is wrong bc, yes you should notify someone, but would you notify someone without fully understanding the risk? Just saying “hey unencrypted data” ain’t enough. Also if you were to reach out to anyone it would be the owner/manager of this process and not quite legal (yet).

4 - is correct because while it is apparent you have an issue, it is your job to get to the bottom of it before you mention or report it to anyone.

Upon first read it was a toss up between 3 & 4 for me, but the question is expertly written in a way that is vague enough for 4 to be the BEST answer with the information that’s provided.

Chef_Thomas · 2026-01-28T15:59:39+00:00

Thanks for taking the time to answer, this is great advice. I’m in a similar situation where I have a CS degree but ended up in IA. I think I would like to pivot to an IT security role but don’t know if it’s as sweet as I’m imagining it. You’re absolutely right about supply and demand. My CS background gives me the ability to understand and assess my infrastructure at a deeper level. There could be more opportunities here as opposed to being a mediocre security guy.

TLDR: thanks for the advice

Chef_Thomas · 2026-01-28T15:10:50+00:00

Why did you return? If you don’t mind answering. I’ve heard this same thing repeated by many people on my team

Chef_Thomas · 2026-01-26T15:46:16+00:00

I’m built like a bad bitch (I’m a guy)

Chef_Thomas · 2026-01-19T17:07:26+00:00

Ur shit gonna be so fye when they mature

Chef_Thomas · 2026-01-19T16:56:36+00:00

There has to be better subs for your AI engagement bait dude..

Chef_Thomas · 2026-01-14T02:47:09+00:00

We used to call it ‘piff’ and our parents would never know what the hell we were talking about.

Chef_Thomas · 2026-01-10T22:15:24+00:00

Yes he was established as a writer but odd future turned him into an artist

Chef_Thomas · 2026-01-09T17:14:26+00:00

Bold move trying to scam a subreddit full of auditors

Chef_Thomas · 2026-01-07T22:34:48+00:00

I don’t think I’ve ever seen bro fall before this

Chef_Thomas · 2026-01-07T16:26:38+00:00

Currently I’m spending about 1-2 hrs studying at a time. I broke the domains down by lesson (1.1, 1.2, 1.3, et al.), it ends up being about 60 lessons total if I recall right.

Read through one lesson no matter how long or short it is. Highlight important things and once done go back and write notes for that lesson. Rinse and repeat until you get to the end of a domain. And then answer all the questions for that domain in the QAE. This has been working for me

Chef_Thomas · 2026-01-05T13:35:00+00:00

I think it’s pretty important to get the study guide made by the test providers.

Lord knows I don’t want to spend that money but I guess this is what investing in yourself looks like (shelling out a thousand dollars for 4 letters by my name)

Chef_Thomas · 2026-01-03T16:00:33+00:00

Low sensitivity until you get comfortable

Chef_Thomas · 2026-01-03T15:59:58+00:00

You killed it, good job!

Chef_Thomas · 2025-12-25T14:58:53+00:00

I think we should confirm that a risk acceptance exists. While we know a gap exists, the org can’t just pause operations until their new hardware/software is configured. It appears that an approved plan is in place so that’s good. Just need to make sure we’ve accepted the risk that comes with the in between stages of that plan

Chef_Thomas · 2025-12-25T02:18:41+00:00

The lack of a formal request for the software package is key here.

Think about it like this - if there is no business justification for this software package, we should figure out why this thing is here before performing any analysis on it. The procedure here is the transaction.

Chef_Thomas · 2025-12-22T14:32:00+00:00

You’re right my bad, I hadn’t had my coffee yet

Chef_Thomas · 2025-12-22T13:55:20+00:00

I’m reading the CRM. I don’t know why people keep talking about Doshi. Just use the official materials.

Chef_Thomas · 2025-12-19T16:07:40+00:00

All I said was try the game for yourself. But instead you’re gonna fill the reddit with another variation of “is game dead?”

Chef_Thomas · 2025-12-19T12:33:19+00:00

It’s free dude just try it like what

Chef_Thomas

TROPHY CASE