Service Provider Management GCCC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which element is typically specified in a Service Level Agreement (SLA) regarding security?

   • AThe organization's internal marketing strategy
   • BThe provider's internal employee salaries
   • CThe maximum allowable time to patch critical vulnerabilities
   • DThe provider's preferred cloud region for all customers
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A software company is contracting with a cloud infrastructure provider to host its application. The company's legal team wants to ensure that the provider cannot use the company's data for any purpose other than providing the service. Which clause is most important to include in the contract?

   • AA data use restriction clause that limits the provider's use of the data to the provision of the service
   • BA service level agreement specifying 99.99% uptime for the application
   • CA right-to-audit clause allowing the company to inspect the provider's security controls
   • DA liability cap limiting the provider's financial responsibility to the contract value
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company is contracting with a managed security services provider (MSSP) that will monitor its SIEM. The contract is being drafted. Which clause is most important to include to ensure the company can verify the MSSP's security controls over time?

   • AA clause requiring the MSSP to notify the company of any security incidents within 72 hours.
   • BA clause requiring the MSSP to maintain cyber liability insurance of at least $5 million.
   • CA clause specifying the MSSP's liability for any data breach caused by its negligence.
   • DA right-to-audit clause allowing the company to review the MSSP's security controls and processes.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the purpose of ongoing monitoring of a service provider's security controls?

   • ATo transfer all security responsibilities to the provider
   • BTo replace the need for periodic risk assessments
   • CTo ensure the provider continues to meet security requirements over time
   • DTo eliminate the need for incident response planning
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is transitioning from one cloud storage provider to another. The old provider has copies of the company's data. What should the company do to ensure a secure transition?

   • ARely on the old provider's standard deletion process without verification.
   • BMigrate the data to the new provider, verify the migration, and then require the old provider to securely delete the data and provide certification of deletion.
   • CAsk the old provider to delete the data immediately before the migration is complete.
   • DLeave the data with the old provider in case the new provider has issues.
   Reveal Solution Discussion Select an answer first