Third-Party Risk SY0-701 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is entering into a contract with a software vendor that will have access to its customer database. The company wants to ensure it can verify the vendor's security controls are effective. Which of the following should be included in the vendor agreement?

   • AA clause requiring the vendor to notify the company within 72 hours of a security incident.
   • BA clause granting the company the right to audit the vendor's security controls and processes.
   • CA clause specifying the vendor's liability for any data breaches.
   • DA clause requiring the vendor to use encryption for all data transmissions.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A healthcare organization is evaluating a new cloud-based patient scheduling vendor. The vendor will store protected health information (PHI) and integrate with the organization's Active Directory. The organization's compliance team requires that the vendor demonstrate compliance with HIPAA and provide evidence of security controls. Which of the following should the organization do FIRST?

   • ASend the vendor a security questionnaire and request a completed HITRUST or SOC 2 report.
   • BRequire the vendor to provide a list of all its subcontractors and their security certifications.
   • CSign a business associate agreement (BAA) with the vendor to ensure PHI is protected.
   • DPerform a penetration test on the vendor's production environment immediately.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which factor is most important to include when assessing a vendor's security risk?

   • AThe vendor's marketing strategy
   • BThe vendor's number of employees
   • CThe vendor's office location
   • DThe vendor's data handling and protection practices
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A security analyst is evaluating a potential vendor that will process customer data. Which activity is the primary purpose of a vendor assessment?

   • ATo transfer all security responsibilities to the vendor
   • BTo determine the vendor's security posture and associated risks before entering a business relationship
   • CTo negotiate the lowest possible price for the vendor's services
   • DTo ensure the vendor uses the same security products as the organization
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company is hiring a third-party to perform a penetration test on its network. The company wants to ensure that the test does not disrupt business operations. The company also wants to ensure that the test is thorough. Which of the following is the BEST way to balance these requirements in the rules of engagement?

   • AAllow the test to be conducted only during off-peak hours, such as weekends.
   • BProhibit any testing that could potentially disrupt operations, such as denial-of-service tests.
   • CAllow the test to be conducted at any time, but require the tester to stop if any disruption occurs.
   • DDefine a testing window that includes both off-peak and low-impact periods, and specify which systems can be tested.
   Reveal Solution Discussion Select an answer first