Third-Party Risk SY0-701 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   During vendor selection, what is the primary purpose of comparing vendors against security and compliance requirements?

   • ATo ensure the vendor has the same security policies as the organization
   • BTo select the vendor with the most security certifications
   • CTo eliminate all vendors that have any security weaknesses
   • DTo choose the vendor that best meets the organization's security needs
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A financial services firm is selecting a third-party payment processor. The firm requires that the processor maintain PCI DSS compliance and provide a service-level agreement (SLA) with a 99.99% uptime guarantee. Two vendors meet these requirements, but Vendor A has a recent data breach, while Vendor B has no breach history but is more expensive. Which of the following is the BEST course of action?

   • ASelect Vendor A because they meet the technical requirements and the breach was not their fault.
   • BConduct a detailed risk assessment of both vendors, including the breach details, before making a decision.
   • CSelect Vendor B because they have a clean security record, even though they cost more.
   • DChoose the cheaper vendor to save money, as both meet the compliance requirements.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A small business is considering a new CRM vendor that will store customer contact information. The business has limited resources and wants a quick but effective way to assess the vendor's security posture. Which of the following is the BEST approach?

   • ASend the vendor a standardized security questionnaire covering key areas like encryption, access control, and incident response.
   • BPerform a background check on the vendor's CEO and key executives.
   • CVisit the vendor's headquarters to inspect their physical security controls.
   • DRequire the vendor to provide a full penetration test report from the last year.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which element is typically defined in rules of engagement for a vendor?

   • AAuthorized testing times and systems
   • BThe vendor's profit margins
   • CThe organization's marketing strategy
   • DThe vendor's employee vacation schedule
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary goal of vendor monitoring?

   • ATo ensure the vendor maintains compliance and performance over time
   • BTo transfer security responsibilities to the vendor
   • CTo reduce the cost of the vendor's services
   • DTo find reasons to terminate the vendor contract
   Reveal Solution Discussion Select an answer first