Service Provider Management GCCC Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which security clause is essential to include in a contract with a service provider?

   • AA requirement for the provider to notify the organization of security incidents within a defined timeframe
   • BA waiver of all liability for data breaches
   • CA statement that the provider's security practices are confidential and not subject to review
   • DA clause allowing the provider to subcontract without approval
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A healthcare organization is evaluating a cloud-based email encryption vendor that will process protected health information (PHI). The vendor has provided a SOC 2 Type II report, but the organization's compliance team notes the report does not include a HIPAA-specific attestation. During the pre-engagement assessment, which action is most important before signing the contract?

   • ARequire the vendor to complete a HIPAA Business Associate Agreement (BAA) as a contractual condition
   • BConduct an on-site audit of the vendor's data center to verify physical security controls
   • CRequest an updated SOC 2 Type II report that explicitly covers the vendor's encryption key management processes
   • DAsk the vendor to provide a list of all subcontractors that may access PHI
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company is considering outsourcing its email security to a third-party provider. The security team is concerned about maintaining visibility into the provider's security controls. Which approach best supports the company's security and compliance needs?

   • APerform a one-time security review before signing the contract and then trust the provider.
   • BEstablish a formal service provider management program that includes risk assessment, contractual requirements, and ongoing monitoring.
   • CRequire the provider to sign a confidentiality agreement and consider the relationship secure.
   • DRely on the provider's marketing materials and public certifications to ensure security.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company's SaaS vendor has suffered a ransomware attack that has encrypted the vendor's systems, including the company's data. The company's own systems are unaffected. What should the company do first?

   • AImmediately notify regulatory authorities of the breach.
   • BAttempt to access the vendor's systems to assess the damage.
   • CRestore the company's data from its own backups.
   • DActivate the incident response plan and contact the vendor's designated security contact.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which activity is a core component of service provider management?

   • APerforming a one-time security review at contract signing
   • BAvoiding any formal agreements to maintain flexibility
   • CDelegating all compliance audits to the provider
   • DContinuously evaluating the provider's security controls and compliance posture
   Reveal Solution Discussion Select an answer first