Identify and Manage Cybersecurity Risks Associated with Suppliers and Third-Party Vendors. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   In the NIST CSF 2.0 GOVERN function, what does supply chain risk management primarily involve?

   • AManaging cybersecurity risks throughout the entire lifecycle of vendor relationships, from selection to termination
   • BTransferring all supplier risks to a third-party insurance provider
   • CEliminating all third-party vendors to reduce risk to zero
   • DEnsuring all suppliers are located in the same geographic region as the organization
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the purpose of vendor risk monitoring in the NIST CSF 2.0 GOVERN function?

   • ATo continuously track suppliers for changes in their cybersecurity risk and compliance status
   • BTo replace all suppliers on an annual basis
   • CTo ensure suppliers pay their invoices on time
   • DTo perform a one-time security assessment before signing a contract
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the purpose of supplier risk response in the NIST CSF 2.0 GOVERN function?

   • ATo terminate all supplier relationships that have any level of risk
   • BTo identify all suppliers that the organization works with
   • CTo develop and implement strategies to mitigate or accept identified cybersecurity risks from suppliers
   • DTo continuously monitor supplier security operations centers
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which activity is part of supply chain risk management?

   • AConducting due diligence on a new supplier before signing a contract
   • BDeleting all supplier data from the organization's systems
   • CInstalling antivirus software on all employee laptops
   • DCreating a new department for supplier management
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A retail company discovered that its point-of-sale (POS) vendor has a critical vulnerability that could allow attackers to access customer payment data. The vendor is working on a patch but it will take two weeks. The company's risk team must respond to this supplier risk. What is the most appropriate immediate response?

   • AImplement temporary compensating controls, such as network segmentation and enhanced logging, until the patch is applied.
   • BAccept the risk because the vendor is reputable and the patch will be applied soon.
   • CDisconnect the POS system from the network and halt all sales operations.
   • DTerminate the contract with the vendor immediately and find a new POS provider.
   Reveal Solution Discussion Select an answer first