Identify and Manage Cybersecurity Risks Associated with Suppliers and Third-Party Vendors. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A government agency is considering a vendor for cloud email services. The vendor's security assessment reveals that they do not encrypt data at rest. The agency's data classification policy requires encryption for all sensitive data. What should the agency do?

   • AAccept the risk because the vendor is well-known and widely used.
   • BUse the vendor but only for non-sensitive email communications.
   • CTerminate the vendor relationship and build an in-house email system.
   • DRequire the vendor to implement encryption at rest as a condition of the contract.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company is considering a new vendor for customer relationship management (CRM). The vendor has provided a completed security questionnaire, but the company's risk team wants to verify the answers. What is the best way to validate the vendor's security posture?

   • AVisit the vendor's website to see if they advertise their security features.
   • BTrust the questionnaire because the vendor completed it in good faith.
   • CRequest independent audit reports, such as SOC 2, and review them for control effectiveness.
   • DAsk the vendor to provide references from other customers.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company is terminating its contract with a marketing agency that had access to customer data. The company's security team must ensure that the agency no longer has access to any company systems or data. What is the most important step in the termination process?

   • AWait for the agency to contact the company when they are ready to return data.
   • BSend a formal email to the agency thanking them for their services.
   • CRevoke all access credentials and confirm the return or destruction of any company data held by the agency.
   • DAsk the agency to sign a non-disclosure agreement after termination.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An organization uses a third-party IT support vendor that has remote access to employee workstations. The vendor recently had a data breach that did not affect the organization. The organization's risk team wants to ensure that the vendor's security posture is still acceptable. What is the best action?

   • AConduct an immediate review of the vendor's incident response and security controls to reassess the risk.
   • BTerminate the vendor relationship immediately without further investigation.
   • CAssume the vendor's security is still acceptable because the breach did not affect the organization.
   • DWait for the vendor to provide a detailed report of the breach before taking any action.
   Reveal Solution Discussion Select an answer first
6. 25application · easy

   A company is about to sign a contract with a new supplier that will provide raw materials and also have access to the company's inventory system for just-in-time delivery. The company's risk team has not yet assessed this supplier. What is the first step the risk team should take?

   • ATerminate the supplier relationship because it has not been assessed.
   • BDevelop a risk response plan for the supplier.
   • CIdentify the cybersecurity risks associated with the supplier's access to the inventory system.
   • DMonitor the supplier's security posture continuously.
   Reveal Solution Discussion Select an answer first