Vendor and Supply Chain Management CDPSE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the purpose of conducting vendor due diligence on privacy practices?

   • ATo monitor the vendor's performance after the contract is signed
   • BTo ensure the vendor has a strong social media presence
   • CTo verify that the vendor has adequate privacy and data protection measures in place before engaging them
   • DTo negotiate the price of the vendor's services
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is a common requirement for a vendor to use a sub-processor?

   • AThe vendor must ensure the sub-processor has a larger market share than the vendor
   • BThe vendor must obtain prior written authorization from the organization before engaging a sub-processor
   • CThe vendor must allow the sub-processor to use the data for its own marketing
   • DThe vendor must inform the organization after the sub-processor has started processing data
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the purpose of defining vendor termination and data return/deletion processes?

   • ATo transfer the data to a third party without the organization's consent
   • BTo ensure that upon contract termination, the vendor securely returns or deletes all personal data in accordance with the contract and laws
   • CTo allow the vendor to keep the data for future business opportunities
   • DTo archive the data indefinitely for the vendor's records
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary purpose of a vendor risk assessment in the context of privacy?

   • ATo identify and evaluate the privacy risks that a vendor's processing activities may pose to the organization
   • BTo compare the vendor's pricing with competitors to negotiate lower costs
   • CTo ensure the vendor's financial stability and profitability before signing a contract
   • DTo determine the market value of the personal data that the vendor will process
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A multinational company is assessing a new vendor that will process personal data of customers in multiple jurisdictions, including the EU and countries with restrictive data transfer laws. The vendor has a strong security posture but has not yet obtained any privacy certifications. The company's legal team is concerned about cross-border data transfers. What is the most appropriate approach?

   • AProceed with the vendor because its strong security posture is sufficient to protect personal data.
   • BRequire the vendor to store all data in the company's home country to avoid transfer issues.
   • CReject the vendor because it lacks privacy certifications, which are mandatory for cross-border data transfers.
   • DConduct a comprehensive risk assessment that includes a review of the vendor's data transfer mechanisms and legal basis for transfers, and require appropriate safeguards in the DPA.
   Reveal Solution Discussion Select an answer first