Service Provider Management GCCC Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company uses a critical SaaS vendor that has been acquired by another company. The acquisition has led to changes in the vendor's leadership and security team. The company's security team is concerned about the vendor's security posture. What is the most effective way to address this concern?

   • AConduct a focused risk reassessment of the vendor, including reviewing updated security documentation and performing a security review.
   • BWait for the vendor to provide updated security documentation before taking any action.
   • CRely on the vendor's existing SOC 2 report because it is still valid.
   • DTerminate the contract with the vendor immediately due to the acquisition.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which activity is part of ongoing monitoring and review of a service provider?

   • ADeleting all logs after the first month of service
   • BIgnoring the provider's performance unless a breach occurs
   • CReviewing the provider's security audit reports and compliance certifications
   • DConducting a one-time security assessment at contract signing
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A logistics company has an SLA with a cloud storage provider that includes a 99.9% availability commitment. Over the past three months, the provider has experienced two outages that resulted in a combined 10 hours of downtime. The company's IT team is reviewing the SLA. What should they do?

   • ATerminate the contract immediately because the provider has violated the SLA
   • BIgnore the outages because the provider has not lost any data
   • CCalculate the actual availability and, if it falls below 99.9%, claim the service credit defined in the SLA
   • DAsk the provider to provide a written explanation of the root cause of each outage
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   When coordinating incident response with a service provider, what should be established in advance?

   • AClear communication channels and escalation procedures
   • BA decision to handle all incidents internally without involving the provider
   • CAn agreement to keep incident details confidential from the organization
   • DA plan to wait for the provider to report incidents voluntarily
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A university is considering a new cloud-based learning management system (LMS) that will store student records. The university's procurement team has received the vendor's security documentation, including a SOC 2 report and a penetration test summary. What is the most important additional step before signing the contract?

   • AReview the vendor's data protection addendum to confirm it aligns with the university's data privacy obligations
   • BSchedule a demonstration of the LMS to evaluate its user interface
   • CCompare the vendor's pricing against two other LMS providers
   • DAsk the vendor to provide a list of all current customers for reference calls
   Reveal Solution Discussion Select an answer first