Managing Negotiations and Vendors GSLC Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is a common mitigation strategy for vendor risk?

   • AAvoiding all third-party vendors
   • BConducting due diligence and regular security assessments of the vendor
   • CRequiring the vendor to sign a non-disclosure agreement
   • DTransferring all risk to the vendor through contract terms
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A security team has a contract with a vendor that provides 24/7 security monitoring. The contract includes SLAs for response time and resolution time. The team wants to evaluate the vendor's performance over the past year. Which approach is MOST effective for this evaluation?

   • ACompare the vendor's SLA reports with the organization's own incident logs and ticketing data.
   • BReview the vendor's self-reported SLA compliance reports and accept them as accurate.
   • CConduct a single penetration test at the end of the year to assess the vendor's effectiveness.
   • DAsk the vendor to provide a summary of their performance and any improvements made.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security manager is preparing to negotiate a renewal with a managed security services provider (MSSP). The current provider has had two major SLA breaches in the past year, and an internal security team has developed the capability to handle 60% of the services in-house. The manager wants to secure a significant price reduction while maintaining the option to exit if the provider does not improve. Which preparation step is MOST critical to achieve this outcome?

   • ADefine a BATNA that includes transitioning the in-house team to cover the remaining services if the provider does not concede.
   • BSet a single, non-negotiable target price based on the industry average for similar MSSP contracts.
   • CFocus exclusively on the SLA breach history to demand a penalty clause without discussing price.
   • DPrepare a list of alternative vendors and plan to switch immediately if the provider does not meet the target price.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security team is selecting a new endpoint detection and response (EDR) vendor. They have defined requirements, issued an RFP, and received responses from five vendors. They now need to narrow the list to two for a proof of concept. Which step should they perform NEXT in the vendor selection process?

   • ASchedule a demonstration with all five vendors to see their products in action.
   • BEvaluate each vendor's response against the defined requirements and score them using a weighted matrix.
   • CCheck references for all five vendors to verify their claims.
   • DNegotiate pricing with all five vendors to get the best deal before shortlisting.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Why is regular communication important in vendor relationship management?

   • AIt allows the organization to dictate all decisions
   • BIt ensures the vendor always agrees with the organization
   • CIt helps identify and resolve issues before they escalate
   • DIt eliminates the need for formal performance reviews
   Reveal Solution Discussion Select an answer first