A retail company has engaged a third-party payment processor. The contract requires the processor to maintain PCI DSS compliance and provide quarterly compliance reports. Six months into the engagement, the processor has missed two quarterly report deadlines. What is the most appropriate next step?

Conduct an independent on-site audit of the processor's PCI DSS controls

Ignore the missed deadlines because the processor has not reported any actual security incidents

Issue a formal notice of breach of contract and require the processor to submit the missing reports within 30 days

Terminate the contract immediately and switch to a new payment processor

What is the first step in securely terminating a service provider relationship?

Immediately cut off all access to the provider's systems

Notify the provider that all security requirements are no longer applicable

Identify and inventory all data and assets held by the provider

Delete all backups to prevent data leakage

During a vendor risk assessment before engagement, what is the first step an organization should take?

Sign a non-disclosure agreement with the provider

Conduct a full on-site audit of the provider's facilities

Identify the criticality of the data and systems the provider will access or process

Require the provider to implement all recommended security controls immediately

A company has an SLA with a cloud provider that includes a 99.9% uptime guarantee and a requirement for the provider to notify the company of any security incident within 24 hours. Over the past quarter, the provider has had two outages, each lasting 30 minutes, and one security incident that was reported after 36 hours. The company's security team wants to enforce the SLA. What is the most appropriate action?

Calculate the total downtime against the uptime guarantee and separately address the late incident notification as a breach of the SLA's reporting requirement.

Request a new SLA with a higher uptime guarantee and a 12-hour notification requirement.

Ignore the late notification because the incident was minor and did not affect the company.

Terminate the contract immediately because the provider violated the SLA.

A government agency has contracted with a cloud provider to host a public-facing website. The contract requires the provider to maintain a specific security configuration and to notify the agency of any changes. The agency's security team wants to verify that the provider is maintaining the required configuration. What is the most effective ongoing monitoring approach?

Rely on the provider's public statements about its security posture

Require the provider to submit regular compliance reports and conduct periodic independent assessments

Conduct a single penetration test at the start of the contract and assume the configuration remains unchanged

Ask the provider to send a monthly email confirming that no changes have been made

GIAC Critical Controls Certification

Domain 1Objective 2

Service Provider Management GCCC Practice Questions (Page 2)

Part of the Foundations and Governance domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 3–4 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

7concepts

Questions 6–10

6application · medium
A retail company has engaged a third-party payment processor. The contract requires the processor to maintain PCI DSS compliance and provide quarterly compliance reports. Six months into the engagement, the processor has missed two quarterly report deadlines. What is the most appropriate next step?
Select an answer first
7foundation · easy
What is the first step in securely terminating a service provider relationship?
Select an answer first
8foundation · easy
During a vendor risk assessment before engagement, what is the first step an organization should take?
Select an answer first
9expert · hard
A company has an SLA with a cloud provider that includes a 99.9% uptime guarantee and a requirement for the provider to notify the company of any security incident within 24 hours. Over the past quarter, the provider has had two outages, each lasting 30 minutes, and one security incident that was reported after 36 hours. The company's security team wants to enforce the SLA. What is the most appropriate action?
Select an answer first
10application · medium
A government agency has contracted with a cloud provider to host a public-facing website. The contract requires the provider to maintain a specific security configuration and to notify the agency of any changes. The agency's security team wants to verify that the provider is maintaining the required configuration. What is the most effective ongoing monitoring approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.

Service Provider Management GCCC Practice Questions (Page 2)

Questions 6–10

A retail company has engaged a third-party payment processor. The contract requires the processor to maintain PCI DSS compliance and provide quarterly compliance reports. Six months into the engagement, the processor has missed two quarterly report deadlines. What is the most appropriate next step?

What is the first step in securely terminating a service provider relationship?

During a vendor risk assessment before engagement, what is the first step an organization should take?

Keep studying — Foundations and Governance