Identify and Manage Cybersecurity Risks Associated with Suppliers and Third-Party Vendors. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is an example of vendor risk monitoring?

   • ASetting up a shared folder for supplier documents
   • BReviewing a supplier's security news and breach reports on a regular basis
   • CConducting a one-time security questionnaire during onboarding
   • DSigning a non-disclosure agreement with a new supplier
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is an example of a supplier risk response strategy?

   • ACreating an inventory of all suppliers and their data access
   • BMonitoring a supplier's security news for breaches
   • CReviewing a supplier's SOC 2 report during onboarding
   • DRequiring a supplier to implement multi-factor authentication before granting access to systems
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company has a vendor that provides critical infrastructure services. The vendor's security assessment reveals that they have not implemented multi-factor authentication (MFA) for remote access. The vendor is the only provider of this service and cannot be easily replaced. The company's risk appetite is moderate. What is the best risk response?

   • AAccept the risk because the vendor is critical and cannot be replaced.
   • BNegotiate a contractual requirement for the vendor to implement MFA within a defined timeframe, and implement compensating controls in the interim.
   • CTransfer the risk by purchasing cyber insurance.
   • DTerminate the vendor relationship and find an alternative, even if it is costly.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A multinational corporation is expanding its use of a cloud-based collaboration vendor. The vendor will now process data from the company's European operations, which is subject to GDPR. The vendor's data centers are located in the United States. The company's risk team must identify and assess the risks associated with this expansion. Which risk is most critical to address?

   • AThe vendor's uptime and availability guarantees.
   • BThe vendor's pricing structure for the expanded services.
   • CThe vendor's physical security measures at their U.S. data centers.
   • DData transfer risks under GDPR, as personal data may be transferred outside the EU without adequate safeguards.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company is evaluating a new vendor for cloud storage. The vendor's security assessment shows that they have strong encryption and access controls, but they have had two minor security incidents in the past year. The company's risk team must decide whether to approve the vendor. What is the most important factor to consider?

   • AThe vendor's pricing compared to other cloud storage providers.
   • BThe vendor's uptime guarantee and service level agreement.
   • CThe vendor's marketing materials and customer testimonials.
   • DThe nature and impact of the past incidents and whether the vendor has taken corrective actions.
   Reveal Solution Discussion Select an answer first