Vendor Management and Procurement Processes CCISO Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A global corporation is evaluating a new IT outsourcing vendor. The vendor has operations in multiple countries, including some with high geopolitical risk. The CISO is concerned about the vendor's ability to maintain service during political instability. Which risk assessment should the CISO prioritize?

   • AReview the vendor's marketing materials
   • BCheck the vendor's social media presence
   • CAssess the vendor's business continuity and disaster recovery plans
   • DEvaluate the vendor's pricing model
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of including evaluation criteria in a Request for Proposal (RFP)?

   • ATo guarantee the lowest price will be selected
   • BTo provide vendors with a clear understanding of how their proposals will be assessed
   • CTo eliminate the need for vendor demonstrations
   • DTo legally bind vendors to submit a proposal
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A university is procuring a new student information system. The procurement team has completed the RFP process and selected a vendor. The contract has been signed, and the vendor is beginning implementation. What is the final step in the procurement process?

   • AConducting a vendor risk assessment
   • BContract closure and performance review after implementation
   • CIssuing a press release about the new vendor
   • DDeveloping a request for quotation (RFQ)
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A manufacturing company needs to procure a new ERP system. The procurement team has completed the requisition and is about to issue an RFP. The CISO wants to ensure that security requirements are incorporated into the vendor evaluation. At which point in the procurement process should the CISO formally document security requirements?

   • ADuring vendor performance monitoring, after the contract is signed
   • BDuring contract negotiation, after the preferred vendor is selected
   • CDuring the requisition approval, before the RFP is drafted
   • DDuring the RFP development, before the RFP is released to vendors
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is negotiating a contract with a new IT outsourcing vendor. The vendor's standard contract includes a clause that allows the vendor to change subcontractors without notifying the company. The CISO is concerned about the security implications. Which contract term should the CISO negotiate?

   • AA clause that requires the vendor to indemnify the company for any subcontractor breaches
   • BA clause requiring prior written approval for any subcontractor changes
   • CA clause that limits the vendor's liability for subcontractor actions
   • DA clause that allows the vendor to change subcontractors with 30 days' notice
   Reveal Solution Discussion Select an answer first