Vendor Management and Procurement Processes CCISO Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A government agency is managing an RFP for a new cybersecurity monitoring platform. The agency has a strict deadline to award the contract before the end of the fiscal year. The RFP evaluation team is large and has conflicting opinions. The CISO must ensure the RFP process is completed on time while maintaining quality. What is the best approach?

   • ALet the most senior evaluator make the final decision
   • BExtend the RFP deadline to allow more time for evaluation
   • CUse a weighted scoring matrix and pre-agreed evaluation criteria to streamline decision-making
   • DSelect the vendor with the lowest price to save time
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which action is most critical to include in a vendor exit plan to ensure the organization retains access to its data after termination?

   • ARequiring the vendor to return or securely destroy all organizational data in a specified format
   • BRelying on the vendor's goodwill to provide data after termination
   • CDeleting all backup copies of the organization's data immediately upon termination notice
   • DWaiting until after termination to discuss data retrieval
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company has a contract with a SaaS vendor that includes an SLA with a 99.9% uptime guarantee. Over the past six months, the vendor has consistently achieved 99.95% uptime, but the company's internal monitoring shows that the vendor's response time to critical incidents has been slower than the SLA target. The vendor disputes the response-time data, claiming the company's monitoring method is inaccurate. The CISO must decide how to handle this dispute. What is the most appropriate action?

   • AAccept the vendor's claim and drop the issue
   • BReview the SLA definitions and agree on a mutually acceptable monitoring methodology
   • CTerminate the contract and find a new vendor
   • DImmediately invoke the SLA penalty clause based on the company's data
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company is selecting a vendor for a new cybersecurity monitoring platform. The company has a limited budget and needs a solution that can be deployed quickly. Two vendors are shortlisted: Vendor A offers a comprehensive platform with advanced features but requires a longer implementation and higher cost. Vendor B offers a simpler platform with fewer features but can be deployed quickly and at lower cost. The CISO must balance the need for comprehensive security with budget and time constraints. Which approach is most appropriate?

   • ASelect Vendor A and negotiate a lower price
   • BSelect Vendor B and plan for future upgrades as the security program matures
   • CSelect Vendor A because it offers the most comprehensive security
   • DDelay the decision until more budget is available
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A retail company is negotiating a contract with a new payment processing vendor. The CISO wants to ensure that the vendor is held accountable for security incidents. Which contract clause should the CISO insist on including?

   • AA limitation of liability clause capped at the contract value
   • BA service level agreement (SLA) with specific security incident response times
   • CA clause allowing the vendor to subcontract without notification
   • DAn automatic renewal clause with no performance review
   Reveal Solution Discussion Select an answer first