Vendor Management and Procurement Processes CCISO Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A multinational corporation is evaluating a vendor for a new HR platform. The vendor is based in a country with different data protection laws, and the corporation operates in multiple jurisdictions with varying data residency requirements. The vendor has proposed a single data center location in its home country. The corporation's legal team has flagged that this may violate data residency laws in some jurisdictions. The CISO must balance the need for a standardized platform with regulatory compliance. What is the most appropriate action?

   • ASelect a different vendor that already has data centers in all required jurisdictions
   • BDefer the decision until the legal team provides a full analysis
   • CRequire the vendor to provide data residency options that comply with each jurisdiction's laws
   • DAccept the single data center location and rely on contractual clauses to address compliance
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A regional bank is selecting a new core banking platform vendor. The bank's strategic plan emphasizes rapid digital product launches, but the bank operates in a jurisdiction with strict data-residency rules. The shortlist includes a large global vendor with a mature product and a smaller local vendor with a more flexible development roadmap. The CISO is asked to recommend the primary vendor-selection criterion. Which criterion should the CISO prioritize?

   • AThe vendor's global market share and brand reputation
   • BThe vendor's ability to host data in an in-country region that meets regulatory requirements
   • CThe vendor's total cost of ownership over a five-year period
   • DThe vendor's willingness to accept unlimited liability for security breaches
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A software development company is considering a new cloud infrastructure vendor. The vendor is a startup with innovative technology but has limited financial history. The CISO is concerned about the vendor's long-term viability. Which risk assessment action should the CISO take?

   • AAccept the risk because the vendor is insured
   • BConduct a financial stability review and include exit strategy provisions in the contract
   • CIgnore financial risk because the technology is superior
   • DRequire the vendor to provide a security audit report only
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company is procuring a new customer relationship management (CRM) system. The procurement team has issued the RFP and received proposals from three vendors. The team is now evaluating the proposals. The CISO wants to ensure that security requirements are evaluated consistently. What should the CISO do?

   • ARely on the procurement team's subjective judgment
   • BAsk each vendor to demonstrate its security features in a live demo
   • CSelect the vendor with the lowest price, assuming security is equal
   • DUse a weighted scoring matrix that includes security criteria and apply it to all proposals
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which activity is part of the procurement process closure phase?

   • ANegotiating service-level agreements
   • BConducting a lessons-learned review and finalizing contract records
   • CEvaluating vendor proposals against criteria
   • DIssuing a request for information to potential vendors
   Reveal Solution Discussion Select an answer first