Service Provider Management GCCC Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A company is expanding its use of external service providers, including cloud infrastructure, SaaS applications, and a managed detection and response (MDR) service. The company currently has no formal service provider management program. The security team is overwhelmed by the number of vendors and inconsistent security practices. What is the most effective first step to improve the situation?

   • ARequire all service providers to sign a standard confidentiality agreement.
   • BDevelop a service provider management policy that defines roles, risk assessment requirements, contractual security standards, and monitoring expectations.
   • CCreate a spreadsheet of all service providers and their security certifications.
   • DTerminate all contracts with service providers that do not meet the company's security standards.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which of the following is a key output of a vendor risk assessment?

   • AA documented risk rating that informs the decision to engage the provider
   • BA completed contract with all security clauses
   • CA guarantee that the provider will never suffer a breach
   • DA list of all the provider's customers
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company is ending its contract with a managed IT services provider. The provider has had access to the company's domain admin accounts and file shares. What is the most important step to complete during the termination process?

   • ASchedule a final meeting to discuss the transition of services to the new provider.
   • BAsk the provider to delete all company data from its systems and provide a written confirmation.
   • CRevoke all access credentials and change shared account passwords immediately.
   • DRequest a final invoice and settle all outstanding payments.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company uses a third-party data analytics vendor that processes sensitive customer data. The vendor recently had a minor security incident that did not affect the company's data. What should the company do as part of ongoing monitoring?

   • AReview the incident details with the vendor to understand the root cause and any impact on the company's data.
   • BIgnore the incident because it did not affect the company's data.
   • CTerminate the contract with the vendor immediately.
   • DRequire the vendor to provide a new SOC 2 report within 30 days.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A financial services firm is negotiating an SLA with a managed security services provider (MSSP) for 24/7 SOC monitoring. The firm's compliance team requires that any security incident be reported to the firm's CISO within 30 minutes of detection. The MSSP's standard SLA states a 60-minute notification window. What should the firm do?

   • AAccept the 60-minute SLA and rely on the MSSP's internal escalation procedures to notify the CISO sooner
   • BAdd a clause requiring the MSSP to notify the firm's legal department instead of the CISO
   • CNegotiate a contractual amendment to reduce the notification SLA to 30 minutes, with a penalty clause for non-compliance
   • DRequire the MSSP to provide a real-time dashboard so the firm can self-detect incidents within 30 minutes
   Reveal Solution Discussion Select an answer first