What is the purpose of a vendor security questionnaire?

To legally bind the vendor to security requirements

To replace the need for a vendor assessment

To provide the vendor with the organization's security policies

To gather information about the vendor's security practices and controls

Which component is typically included in a vendor agreement to address security and risk management?

Marketing and advertising guidelines

Data protection and confidentiality clauses

Product pricing and discount structures

An organization has a critical vendor that provides cloud infrastructure services. The vendor has experienced a minor security incident that did not affect the organization's data. The organization's security team wants to ensure the vendor addresses the root cause. Which of the following is the BEST action to take?

Ignore the incident because it did not affect the organization's data.

Require the vendor to provide a root cause analysis (RCA) and a corrective action plan.

Terminate the contract with the vendor immediately.

Conduct a full audit of the vendor's entire infrastructure.

What is the purpose of including a right-to-audit clause in a vendor agreement?

To allow the organization to verify the vendor's compliance with security requirements

To give the vendor access to the organization's network

To require the vendor to purchase security insurance

To transfer liability for all security incidents to the vendor

An organization uses a third-party vendor for its email security gateway. The organization's security team wants to ensure the vendor is responding to emerging threats in a timely manner. Which of the following is the MOST effective way to monitor the vendor's performance?

Wait for the vendor to report any major incidents to the organization.

Subscribe to the vendor's blog and social media channels for updates.

Review the vendor's service-level agreement (SLA) metrics monthly and compare them to actual performance.

Conduct an annual survey of employees to gauge their satisfaction with the email gateway.

CompTIASecurity+

Domain 5Objective 3

Third-Party Risk SY0-701 Practice Questions (Page 4)

Part of the Security program management and oversight domain, which accounts for 20% of the SY0-701 exam. CompTIA does not publish an official question count, but from its 90-minute exam (~35–60 total, ~7–12 in this domain), expect 1–2 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

6concepts

20%of the exam

Questions 16–20

16foundation · easy
What is the purpose of a vendor security questionnaire?
Select an answer first
17foundation · easy
Which component is typically included in a vendor agreement to address security and risk management?
Select an answer first
18expert · hard
An organization has a critical vendor that provides cloud infrastructure services. The vendor has experienced a minor security incident that did not affect the organization's data. The organization's security team wants to ensure the vendor addresses the root cause. Which of the following is the BEST action to take?
Select an answer first
19foundation · easy
What is the purpose of including a right-to-audit clause in a vendor agreement?
Select an answer first
20application · medium
An organization uses a third-party vendor for its email security gateway. The organization's security team wants to ensure the vendor is responding to emerging threats in a timely manner. Which of the following is the MOST effective way to monitor the vendor's performance?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SY0-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “SY0-701” is a trademark of its owner, used for identification only.