Vendor and Supply Chain Management CDPSE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is a key element of a vendor breach notification procedure?

   • AA clause that allows the vendor to decide whether a breach is reportable
   • BA procedure for the vendor to delete all data immediately after a breach
   • CA requirement for the vendor to notify the media before the organization
   • DA defined timeframe within which the vendor must notify the organization of a breach
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Why is it important for an organization to manage and control vendor use of sub-processors?

   • ATo reduce the vendor's operational costs
   • BTo maintain accountability and ensure that sub-processors also comply with privacy requirements
   • CTo eliminate the need for a data processing agreement with the vendor
   • DTo allow sub-processors to use the data for their own purposes
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is terminating its contract with a data storage vendor. The contract includes a clause requiring the vendor to return or delete all personal data upon termination. What is the most important step for the company to take to ensure compliance with this clause?

   • AAssume the vendor will delete the data because the contract requires it.
   • BRequest a written certification from the vendor that all personal data has been deleted or returned.
   • CRely on the vendor's verbal confirmation that the data has been deleted.
   • DImmediately destroy any backup tapes the vendor may have.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company's vendor, a cloud storage provider, suffers a ransomware attack that encrypts customer data. The vendor's contract requires notification within 24 hours of becoming aware of a breach. The vendor notifies the company after 48 hours. What is the most appropriate action for the company to take?

   • ADocument the late notification and assess the impact on the company's own breach notification obligations.
   • BReport the vendor to law enforcement for failing to notify on time.
   • CIgnore the late notification because the vendor eventually notified the company.
   • DTerminate the contract immediately due to the vendor's failure to meet the notification deadline.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A healthcare organization is considering a cloud-based patient scheduling vendor. The vendor will process protected health information (PHI) on behalf of the organization. During the initial risk assessment, the organization discovers that the vendor stores data in a country with different data protection laws. What is the most appropriate action for the organization to take?

   • AConduct a detailed due diligence review of the vendor's privacy practices and legal compliance in the relevant jurisdiction before proceeding.
   • BProceed with the vendor, as the vendor is contractually obligated to comply with the organization's data protection requirements.
   • CReject the vendor immediately because any cross-border data transfer is prohibited under privacy regulations.
   • DRequire the vendor to sign a data processing agreement that includes standard contractual clauses, and then proceed.
   Reveal Solution Discussion Select an answer first