Vendor Management and Procurement Processes CCISO Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A global bank is assessing a new vendor for a critical payment processing system. The vendor is based in a country with strict data localization laws, which conflict with the bank's global data aggregation strategy. The bank's legal team says the vendor's data handling practices may violate the bank's compliance requirements. The vendor offers the best technology and price. What should the CISO do?

   • AAccept the vendor and adjust the bank's data aggregation strategy
   • BReject the vendor because the data handling conflict cannot be resolved without violating compliance
   • CProceed with the vendor and monitor for compliance issues
   • DAsk the vendor to sign a waiver absolving the bank of compliance responsibility
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   When evaluating potential vendors for a new security monitoring service, which criterion is most directly tied to ensuring the vendor's offerings align with the organization's long-term strategic security goals?

   • AVendor's lowest proposed price for the initial contract term
   • BVendor's geographic proximity to the organization's headquarters
   • CVendor's current market share in the security industry
   • DVendor's ability to support the organization's future technology roadmap
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A manufacturing firm has a long-term contract with a raw materials supplier. The supplier has been reliable, but the CISO wants to strengthen the relationship to ensure preferential treatment during supply shortages. Which action is most effective?

   • AThreaten to switch suppliers if shortages occur
   • BEstablish a strategic partnership program with regular executive meetings
   • CRequest a discount without any commitment
   • DReduce the volume of orders to test the supplier
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A manufacturing company needs to procure a new enterprise resource planning (ERP) system. The procurement team has issued an RFP and received responses from three vendors. The team is now evaluating the proposals. According to the standard procurement process, what should the team do immediately after evaluating the proposals?

   • ADevelop a detailed statement of work for the selected vendor
   • BConduct a vendor risk assessment on all three vendors
   • CEnter into contract negotiations with the selected vendor
   • DIssue a purchase order to the vendor with the lowest bid
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A hospital is negotiating a contract with a cloud storage vendor for patient records. The CISO wants to ensure that the vendor's liability for a data breach is clearly defined. Which contract clause is most important?

   • AA clause that requires the hospital to indemnify the vendor
   • BA clause allowing the vendor to change data storage locations at its discretion
   • CA clause that limits the vendor's liability to the contract value
   • DA data breach liability and indemnification clause
   Reveal Solution Discussion Select an answer first