Vendor and Supply Chain Management CDPSE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A multinational corporation is entering into a data processing agreement (DPA) with a cloud infrastructure provider. The provider will process personal data of EU data subjects. What is a critical element that must be included in the DPA to comply with GDPR?

   • AA clause requiring the processor to act only on documented instructions from the controller.
   • BA clause permitting the processor to retain data indefinitely for its own purposes.
   • CA clause allowing the processor to use sub-processors without notifying the controller.
   • DA clause stating that the processor is not required to assist the controller with data subject requests.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a typical contractual privacy clause that should be included in a vendor agreement?

   • AA clause that exempts the vendor from any liability for data breaches
   • BA clause requiring the vendor to implement appropriate technical and organizational security measures
   • CA clause allowing the vendor to use personal data for its own marketing purposes
   • DA clause that requires the vendor to share personal data with any third party upon request
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is an example of a vendor due diligence activity?

   • ASending the vendor a monthly invoice for services rendered
   • BUpdating the vendor's contact information in the organization's directory
   • CReviewing the vendor's privacy policy and data protection certifications
   • DConducting a customer satisfaction survey about the vendor's products
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is an example of an ongoing vendor monitoring activity?

   • ASending the vendor a holiday greeting card
   • BConducting a one-time background check on the vendor's CEO
   • CAsking the vendor to provide a list of its employees' birthdays
   • DReviewing the vendor's audit reports and security certifications on a regular basis
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company has an ongoing vendor monitoring program. During a periodic review, the company discovers that a vendor has been sub-processing personal data without authorization, in violation of the DPA. The vendor claims it was necessary for service continuity. What is the most appropriate action for the company to take?

   • AIssue a formal notice of breach of contract, require the vendor to cease the unauthorized sub-processing, and assess the impact on data subjects.
   • BReport the vendor to the data protection authority without notifying the vendor.
   • CAccept the vendor's explanation and update the DPA to include the sub-processor retroactively.
   • DTerminate the contract immediately without further investigation.
   Reveal Solution Discussion Select an answer first