A logistics company has contracted with a software vendor for a fleet management system. The contract includes an SLA with a 99.9% uptime guarantee. After six months, the vendor has consistently achieved 99.5% uptime. What should the CISO do first?

Renegotiate the SLA to lower the uptime target

Initiate the contract penalty process as defined in the SLA

Terminate the contract immediately

Ignore the shortfall because it is close to the target

What is the primary purpose of establishing key performance indicators (KPIs) for vendor performance monitoring?

To replace the need for regular communication with the vendor

To guarantee the vendor will meet all service levels

To provide an objective basis for evaluating and improving vendor performance

To create a legal basis for terminating the contract

A bank has an ongoing relationship with a core banking system vendor. The vendor has been meeting SLAs, but the CISO notices that the vendor's security patches are often delayed. The CISO wants to improve the relationship and ensure timely patching. Which approach is most effective?

Publicly criticize the vendor to pressure them

Immediately switch to a different vendor

Schedule regular security review meetings with the vendor to discuss patching timelines

Reduce the vendor's contract scope as punishment

A retail company is considering a new payment processing vendor. The vendor is a startup with an innovative product but has limited operating history. The company's risk committee wants to understand the vendor's financial stability before signing a contract. Which action should the CISO take?

Rely on the vendor's marketing materials and customer testimonials

Conduct a financial due-diligence review, including credit checks and review of the vendor's financial statements

Require the vendor to purchase cyber insurance as a substitute for financial review

Defer financial assessment until after the contract is signed

EC-CouncilCertified Chief Information Security Officer

Domain 5Objective 6

Vendor Management and Procurement Processes CCISO Practice Questions (Page 11)

Part of the Strategic Planning, Finance, Procurement, and Vendor Management domain, which makes up ~21% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~13–21 in this domain), expect 2–4 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

8concepts

Questions 51–54

51application · medium
A logistics company has contracted with a software vendor for a fleet management system. The contract includes an SLA with a 99.9% uptime guarantee. After six months, the vendor has consistently achieved 99.5% uptime. What should the CISO do first?
Select an answer first
52foundation · easy
What is the primary purpose of establishing key performance indicators (KPIs) for vendor performance monitoring?
Select an answer first
53application · medium
A bank has an ongoing relationship with a core banking system vendor. The vendor has been meeting SLAs, but the CISO notices that the vendor's security patches are often delayed. The CISO wants to improve the relationship and ensure timely patching. Which approach is most effective?
Select an answer first
54application · medium
A retail company is considering a new payment processing vendor. The vendor is a startup with an innovative product but has limited operating history. The company's risk committee wants to understand the vendor's financial stability before signing a contract. Which action should the CISO take?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.