Third-Party Risk SY0-701 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which activity is an example of ongoing vendor monitoring?

   • ASelecting a vendor based on price
   • BTerminating the vendor contract after a breach
   • CConducting a one-time security assessment before signing the contract
   • DReviewing the vendor's security audit reports periodically
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A multinational corporation is evaluating a new payroll vendor that will process employee data for multiple countries. The vendor is based in a country with different data protection laws. Which of the following is the MOST important factor to consider during the vendor assessment?

   • AThe vendor's ability to provide a multi-language user interface.
   • BThe vendor's compliance with applicable data protection regulations in each country where employees are located.
   • CThe vendor's experience with companies of similar size.
   • DThe vendor's cost compared to other payroll providers.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company is hiring a third-party to conduct a social engineering assessment of its employees. The company wants to ensure that the assessment does not violate any laws or employee privacy rights. Which of the following should be included in the rules of engagement?

   • AThe budget for the assessment.
   • BA list of approved social engineering techniques, such as phishing emails and phone calls.
   • CThe names of employees who will be tested.
   • DThe expected outcome of the assessment.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A large enterprise is evaluating a new SaaS vendor for its customer relationship management (CRM) system. The vendor will store customer data, including personal information. The enterprise's security team has limited time and resources. They have received a completed security questionnaire from the vendor, but the vendor has not provided any third-party audit reports. Which of the following is the BEST next step?

   • ARequest a copy of the vendor's SOC 2 Type II report or similar independent audit report.
   • BProceed with the vendor because the questionnaire was completed thoroughly.
   • CAccept the vendor's questionnaire responses as sufficient evidence of security posture.
   • DConduct a full penetration test of the vendor's infrastructure before proceeding.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is contracting with a vendor that will provide remote support for its internal applications. The vendor will need to access the company's network via VPN. The company wants to ensure that the vendor's access is limited to only the necessary systems and timeframes. Which of the following is the BEST way to address this in the vendor agreement?

   • AInclude a clause specifying that the vendor's access is restricted to the systems and timeframes necessary for support.
   • BInclude a clause requiring the vendor to log all remote access sessions.
   • CInclude a clause requiring the vendor to use multi-factor authentication (MFA) for all remote access.
   • DInclude a clause requiring the vendor to use a dedicated VPN connection.
   Reveal Solution Discussion Select an answer first