Identify and Manage Cybersecurity Risks Associated with Suppliers and Third-Party Vendors. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A regional bank is onboarding a new payment processing vendor. The vendor will handle cardholder data and connect to the bank's core systems via API. The bank's risk team needs to identify cybersecurity risks before signing the contract. Which action best supports supplier risk identification?

   • ARequire the vendor to sign a data processing agreement and indemnify the bank for any breach costs.
   • BReview the vendor's SOC 2 Type II report and penetration test results to identify control gaps relevant to cardholder data.
   • CAsk the vendor to provide a list of all their clients to assess if they are reputable.
   • DSchedule a quarterly business review meeting with the vendor to discuss service levels.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company has multiple vendors that provide various services. The company's risk team has identified that one vendor has a high risk due to poor security practices. The vendor is critical to operations and cannot be easily replaced. What is the best risk response?

   • ATransfer the risk by purchasing cyber insurance.
   • BAccept the risk because the vendor is critical and cannot be replaced.
   • CTerminate the vendor relationship immediately despite the operational impact.
   • DWork with the vendor to develop a remediation plan and set a timeline for improvements.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A financial institution has a third-party vendor that provides fraud detection services. The vendor's service is critical, and any disruption could result in significant financial losses. The vendor recently experienced a major outage due to a ransomware attack. The institution's risk team must decide how to respond. What is the most appropriate action?

   • ATerminate the vendor contract immediately and seek a new fraud detection provider.
   • BActivate the business continuity plan and implement manual fraud detection procedures while assessing the vendor's recovery status.
   • CWait for the vendor to recover and then review the incident report.
   • DAccept the risk because the vendor has a good track record.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A manufacturing company is selecting a new logistics partner that will have access to its inventory management system. The company's security policy requires that all third parties with system access undergo a security review. The logistics partner has a history of minor security incidents but offers the best operational capabilities. What should the company do?

   • AAsk the vendor to sign a waiver absolving the company of any liability from security incidents.
   • BAccept the risk without any additional controls because the vendor is operationally superior.
   • CReject the vendor solely based on the incident history and select a less capable alternative.
   • DProceed with the vendor but implement compensating controls such as limited access and enhanced monitoring.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company's risk assessment of a new vendor reveals that the vendor has a moderate risk due to lack of background checks for their employees. The vendor will have access to the company's building management system. The company decides to accept this risk. What should the company document?

   • AThe rationale for accepting the risk, including the business need and any compensating controls.
   • BA request for the vendor to implement background checks in the future.
   • CA plan to terminate the vendor if any security incident occurs.
   • DA note that the risk was not identified during the assessment.
   Reveal Solution Discussion Select an answer first