Service Provider Management GCCC Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company is transitioning from a legacy on-premises CRM to a new SaaS CRM. The legacy system is managed by an external vendor. The contract with the vendor includes a data-return clause but does not specify a format. The company's IT team needs to migrate the data to the new SaaS provider. What is the most important consideration during the transition?

   • AEnsure the data is exported in a format that the new SaaS provider can import, and verify the integrity of the migrated data
   • BAsk the legacy vendor to delete the data immediately after the export to reduce storage costs
   • CSchedule a meeting with the new SaaS provider to discuss the migration timeline
   • DRequire the legacy vendor to provide a written certification of data deletion before the migration begins
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of service provider management in an organization?

   • ATo ensure that third-party services meet the organization's security and compliance requirements throughout the relationship
   • BTo eliminate the need for internal security policies when using external providers
   • CTo transfer all security responsibilities to the service provider once a contract is signed
   • DTo reduce the cost of IT services by outsourcing security monitoring entirely
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A bank has a contract with a cloud provider that includes a right-to-audit clause. The bank's compliance team wants to verify the provider's security controls, but the provider has declined the audit, citing the confidentiality of its other customers. The contract does not specify the audit's scope or frequency. What should the bank do?

   • ATerminate the contract immediately because the provider refused the audit
   • BNegotiate a mutually agreeable audit scope that protects the provider's other customers while allowing the bank to verify its relevant controls
   • CAccept the provider's refusal because the contract does not specify the audit scope
   • DAsk the provider to provide a summary of its security controls instead of an audit
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company uses a SaaS vendor for its CRM. The vendor has been stable, but the security team wants to implement ongoing monitoring of the vendor's security posture. Which approach is most effective?

   • ASchedule quarterly reviews of the vendor's SOC 2 report and any published security updates.
   • BRely on the vendor's annual security certification as sufficient ongoing assurance.
   • CAsk the vendor to provide a new security questionnaire every time a feature is released.
   • DPerform a full on-site audit of the vendor's facilities every month.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is evaluating a new cloud-based HR platform that will process employee PII. The vendor has passed an initial security questionnaire and provided a SOC 2 Type II report. Before signing the contract, the security team wants to ensure the vendor's security posture is validated independently. Which action best addresses this need?

   • ARely on the SOC 2 Type II report as sufficient evidence of the vendor's security posture.
   • BRequest a third-party penetration test report from the vendor and review the scope and findings.
   • CConduct a vulnerability scan of the vendor's internal network from the internet.
   • DRequire the vendor to sign a business associate agreement (BAA) before proceeding.
   Reveal Solution Discussion Select an answer first