Vendor and Supply Chain Management CDPSE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company is negotiating a DPA with a software vendor that will process customer data. The vendor insists on a clause that limits its liability to the amount paid under the contract. The company's legal team is concerned about this limitation. What is the most appropriate response?

   • ANegotiate for a liability cap that is reasonable and proportionate to the risk, and ensure it does not exclude liability for breaches of data protection obligations.
   • BRequire the vendor to obtain additional insurance to cover any liability above the cap.
   • CReject the contract entirely because any liability cap is unacceptable.
   • DAccept the clause because liability caps are standard in the industry.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A financial services firm is negotiating a contract with a marketing analytics vendor. The vendor will process customer personal data to provide insights. The firm's privacy team wants to ensure that the vendor is obligated to notify them of any data breach in a timely manner. Which contractual clause is most essential to address this requirement?

   • AA clause granting the firm the right to audit the vendor's security controls annually.
   • BA clause requiring the vendor to delete all personal data upon termination of the contract.
   • CA clause requiring the vendor to maintain cyber liability insurance coverage.
   • DA clause specifying the vendor's obligation to notify the firm without undue delay after becoming aware of a personal data breach.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A software-as-a-service (SaaS) vendor that processes customer data for a marketing firm experiences a security incident that may have exposed personal data. The vendor's contract with the firm includes a breach notification clause. What should the vendor do first?

   • AInform the affected individuals directly to ensure they can protect themselves.
   • BNotify the data protection authority directly, as the vendor is the data processor.
   • CNotify the marketing firm as soon as possible, providing details about the incident and the data involved.
   • DWait until the investigation is complete before notifying the firm to provide accurate information.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A retail company is evaluating a new customer support vendor that will handle customer service inquiries, including access to customer accounts. The vendor has provided a SOC 2 Type II report and references from existing clients. What additional due diligence step should the company take to assess the vendor's privacy practices?

   • AAsk the vendor to sign a non-disclosure agreement to protect the company's confidential information.
   • BRequest a list of the vendor's sub-processors and their locations.
   • CAccept the SOC 2 Type II report as sufficient evidence of the vendor's privacy compliance.
   • DReview the vendor's privacy policy and procedures for handling customer data, including employee access controls.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An organization has contracted with a payroll processing vendor that handles employee personal data. The contract includes provisions for ongoing monitoring. Which practice best demonstrates effective ongoing vendor monitoring?

   • AWaiting for the vendor to report any issues before taking action.
   • BRelying on the vendor's self-assessment questionnaire submitted at the time of contract signing.
   • CConducting an annual review of the vendor's security and privacy controls, including reviewing audit reports and incident logs.
   • DReviewing the vendor's financial stability quarterly to ensure they remain in business.
   Reveal Solution Discussion Select an answer first