Identify and Manage Cybersecurity Risks Associated with Suppliers and Third-Party Vendors. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A small business uses a third-party payroll vendor that processes employee data. The vendor's security assessment shows they have strong encryption but lack multi-factor authentication (MFA) for their administrators. The business's risk appetite is low. What is the most appropriate risk response?

   • ASwitch to a different payroll vendor that has MFA, even if it costs more.
   • BAccept the risk because the vendor has strong encryption.
   • CRequire the vendor to implement MFA for all administrative accounts as a condition of continued service.
   • DReduce the amount of data shared with the vendor to minimize exposure.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A university is expanding its use of a software vendor that provides student information systems. The vendor will now have access to more sensitive data, including financial aid records. The university's risk manager needs to identify new risks introduced by this expanded access. What is the best approach?

   • AConduct a new risk assessment focused on the vendor's access to financial aid data and the associated threats.
   • BAsk the vendor to provide a list of all other universities using their system.
   • CRely on the vendor's existing security certifications without further review.
   • DReview the vendor's financial stability to ensure they can continue operations.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A healthcare organization is evaluating a cloud-based EHR vendor. The vendor will store protected health information (PHI). The organization's compliance team must assess the vendor's cybersecurity posture before approving the relationship. Which assessment activity is most appropriate?

   • AConduct a third-party risk assessment using a standardized questionnaire and review the vendor's HITRUST certification.
   • BPerform a full on-site audit of the vendor's data centers and development offices.
   • CRequest the vendor's insurance certificate and assume coverage implies adequate security.
   • DRely on the vendor's marketing materials and customer testimonials to gauge security.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A financial services firm uses a third-party cloud provider for data analytics. The firm's risk team wants to ensure that the provider's security posture remains acceptable over time. Which practice best supports vendor risk monitoring?

   • AMonitor the provider's social media accounts for any negative customer feedback.
   • BPerform a one-time comprehensive assessment at contract signing and never revisit.
   • CWait for the provider to notify the firm of any security incidents before taking action.
   • DReview the provider's security certifications and incident reports on an annual basis.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company has a third-party vendor that provides web hosting services. The vendor recently changed its data center location to a different country. The company's risk team needs to understand the impact of this change. What is the most important consideration?

   • AAsk the vendor to provide a list of other customers using the new data center.
   • BReview the vendor's new data center's physical security measures.
   • CAssess whether the new data center location introduces new legal or regulatory risks, such as data residency requirements.
   • DCheck if the vendor's pricing has changed with the new location.
   Reveal Solution Discussion Select an answer first