Service Provider Management GCCC Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company is ending its relationship with an IT outsourcing provider. The provider has access to the company's Active Directory and email systems. The company's security team wants to ensure that the provider's access is revoked immediately upon contract termination. What should be done?

   • ASchedule a meeting with the provider to discuss the transition plan after the termination date
   • BChange the company's domain name to prevent the provider from accessing the systems
   • CRevoke all provider accounts and credentials at the effective termination time and verify the revocation with a test
   • DAsk the provider to voluntarily delete its own accounts after the termination date
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company is evaluating a new payment processing vendor. The vendor handles credit card data and will store it on its own systems. The company is subject to PCI DSS. What should the company do before signing the contract?

   • AVerify the vendor's PCI DSS compliance through its Attestation of Compliance (AOC) and review the scope of the assessment.
   • BRequire the vendor to provide a SOC 2 Type I report instead of a PCI DSS AOC.
   • CInclude a contract clause that transfers all PCI DSS liability to the vendor.
   • DRely on the vendor's statement that it is 'PCI compliant' without documentation.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A manufacturing company is contracting with a cloud backup provider. The provider will store production data, including intellectual property. The company's legal team wants to ensure that if the contract is terminated, the provider cannot retain copies of the data. Which clause is most important to include in the contract?

   • AA right-to-audit clause allowing the company to inspect the provider's security controls
   • BA data destruction clause requiring the provider to delete all copies of the data and provide a written certification within a specified timeframe
   • CA liability cap limiting the provider's financial responsibility to the contract value
   • DA service level agreement specifying 99.9% uptime for backup availability
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company's cloud infrastructure provider has detected a breach that may affect the company's data. The company has an incident response plan but no specific procedures for coordinating with the provider. What should the company do first?

   • AWait for the provider to issue a public statement before taking any action.
   • BContact the provider's security team to establish communication and gather details about the breach.
   • CTerminate the contract with the provider to limit further exposure.
   • DImmediately notify all customers of the breach.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A multinational corporation uses a managed detection and response (MDR) provider. The MDR contract requires the provider to notify the corporation within 15 minutes of detecting a critical incident. During a ransomware event, the MDR provider detects the incident but delays notification by 45 minutes because its internal team was validating the alert. The corporation's security team is reviewing the incident. What is the most appropriate action?

   • AInvoke the SLA service credit for the missed notification deadline and require a root-cause analysis of the delay
   • BTerminate the MDR contract immediately and engage a new provider
   • CAccept the delay because the MDR provider was validating the alert to avoid a false positive
   • DAsk the MDR provider to adjust its notification procedure to allow more time for validation
   Reveal Solution Discussion Select an answer first