Vendor Management and Procurement Processes CCISO Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A financial services firm is selecting a cloud-based customer relationship management (CRM) vendor. The firm's CISO requires that customer data remain within the country of operation, and the procurement team wants to minimize the number of vendors to manage. The shortlist includes a global CRM provider with a local data center and a regional CRM provider with a strong security track record. Which vendor selection criterion should the CISO emphasize as the primary deciding factor?

   • ATotal cost of ownership over five years
   • BData residency and sovereignty capabilities
   • CVendor's market share and brand reputation
   • DIntegration ease with existing on-premises systems
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A university is issuing an RFP for a new student information system. The RFP team wants to ensure that vendors provide sufficient detail about their data protection measures. Which section should the RFP include?

   • AA requirement that vendors sign a non-disclosure agreement before responding
   • BA general statement that vendors must comply with all applicable laws
   • CA detailed security requirements section that asks vendors to describe their data protection controls and provide evidence
   • DA request for the vendor's marketing brochure on security
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A media company has an SLA with a content delivery network (CDN) vendor that specifies a 99.99% availability target. The vendor has been meeting the target, but the CISO wants to ensure that the vendor's performance is consistently monitored. Which metric should the CISO track?

   • ANumber of new features released by the vendor
   • BVendor's employee satisfaction scores
   • CNumber of support tickets opened by the company
   • DPercentage of uptime calculated from the vendor's monitoring reports
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A healthcare organization is preparing an RFP for a new electronic health record (EHR) system. The CISO wants to ensure that vendors' security capabilities are thoroughly evaluated. Which action should the CISO take during the RFP development phase?

   • AWait until after vendor selection to conduct security assessments
   • BInclude mandatory security requirements and a security questionnaire in the RFP
   • CAsk vendors to provide their security certifications after contract signing
   • DRely on vendor marketing materials for security information
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company has decided to terminate its contract with a cloud storage vendor due to repeated security incidents. The contract includes a 90-day transition period. The CISO is responsible for ensuring a smooth exit. Which action should the CISO take first?

   • ADevelop a detailed exit plan that includes data migration, asset recovery, and timeline
   • BImmediately delete all data from the vendor's cloud storage
   • CNotify the vendor that the contract is terminated effective immediately
   • DAsk the vendor to provide a list of all data stored
   Reveal Solution Discussion Select an answer first