Third-Party Risk SY0-701 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An organization has contracted with a cloud storage vendor to host sensitive customer data. The contract includes a requirement for the vendor to undergo an annual SOC 2 Type II audit. Which of the following is the MOST effective way for the organization to monitor the vendor's ongoing compliance?

   • AConduct a quarterly vulnerability scan of the vendor's external IP addresses.
   • BWait for the vendor to notify the organization of any compliance issues.
   • CRely on the vendor's self-assessment that they are compliant.
   • DRequest a copy of the SOC 2 Type II report and review the results and any exceptions.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which topic should be covered in a vendor security questionnaire?

   • AEmployee satisfaction surveys
   • BOffice furniture inventory
   • CIncident response procedures
   • DMarketing budget
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the purpose of rules of engagement in vendor interactions?

   • ATo provide the vendor with access to all organizational systems
   • BTo transfer liability for security incidents to the vendor
   • CTo establish the vendor's pricing structure
   • DTo define the boundaries and expectations for security testing and communication
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A government agency is selecting a cloud provider to host non-classified but sensitive data. The agency requires that the provider comply with FedRAMP. Two providers meet the FedRAMP requirement, but Provider A has a higher authorization level (e.g., FedRAMP High) while Provider B has a lower level (e.g., FedRAMP Moderate). Which of the following is the MOST important consideration in the selection?

   • AThe specific security controls required for the data's classification.
   • BThe provider's geographic location and data center redundancy.
   • CThe provider's customer support response time.
   • DThe cost difference between the two providers.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company has hired a third-party security firm to conduct a penetration test on its web application. The company wants to ensure the test does not disrupt production services. Which of the following should be defined in the rules of engagement?

   • AThe contact information of the company's IT team for emergencies.
   • BThe specific IP addresses and domains that are in scope for the test.
   • CThe payment terms and schedule for the penetration test.
   • DThe hours during which testing can be performed and the types of tests allowed.
   Reveal Solution Discussion Select an answer first