A company has an SLA with a cloud provider that includes a 99.9% uptime guarantee. The provider has experienced several outages this quarter, and the company wants to ensure the SLA is being met. What should the company do?

Assume the provider is meeting the SLA because it is a large, reputable company.

Track the provider's actual uptime against the SLA and request credits if the uptime falls below the guarantee.

Terminate the contract immediately due to the outages.

Ask the provider to increase the uptime guarantee to 99.99% in the next contract renewal.

Why should a contract with a service provider include audit rights?

To eliminate the need for ongoing monitoring

To transfer all security responsibilities to the provider

To allow the organization to verify the provider's compliance with security requirements

To give the provider access to the organization's internal systems

During termination of a service provider, what should be done with the organization's data stored by the provider?

Transfer the data to any new provider without verification

Leave the data with the provider for future use

Return or securely destroy the data according to the contract and legal requirements

Delete the data immediately without documentation

What is a key element of an incident response coordination plan with a service provider?

Ensuring the provider has no access to incident-related data

Defining the roles and responsibilities of both parties during an incident

Avoiding any documentation of the incident to prevent legal issues

Requiring the provider to handle all incidents without notifying the organization

An organization is terminating its contract with a legacy SaaS HR platform and transitioning to a new provider. The old provider's contract includes a data-return clause but does not specify a format or timeline. The organization's security team is concerned about residual data left on the old provider's infrastructure. What should the organization do first?

Schedule a joint meeting with the old and new providers to discuss data migration responsibilities

Request a copy of the provider's backup tapes to ensure no data is lost during the transition

Invoke the data-return clause and require the provider to export all data in a machine-readable format before the contract end date

Ask the provider to delete all data immediately and provide a written certification of deletion

GIAC Critical Controls Certification

Domain 1Objective 2

Service Provider Management GCCC Practice Questions (Page 4)

Part of the Foundations and Governance domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 3–4 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

7concepts

Questions 16–20

16application · medium
A company has an SLA with a cloud provider that includes a 99.9% uptime guarantee. The provider has experienced several outages this quarter, and the company wants to ensure the SLA is being met. What should the company do?
Select an answer first
17foundation · easy
Why should a contract with a service provider include audit rights?
Select an answer first
18foundation · easy
During termination of a service provider, what should be done with the organization's data stored by the provider?
Select an answer first
19foundation · easy
What is a key element of an incident response coordination plan with a service provider?
Select an answer first
20application · medium
An organization is terminating its contract with a legacy SaaS HR platform and transitioning to a new provider. The old provider's contract includes a data-return clause but does not specify a format or timeline. The organization's security team is concerned about residual data left on the old provider's infrastructure. What should the organization do first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.