Vendor and Supply Chain Management CDPSE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company's vendor, a data analytics provider, suffers a breach that exposes personal data of the company's customers. The vendor's contract requires notification within 24 hours, but the vendor notifies the company after 72 hours. The company's own regulatory deadline for notifying authorities is 72 hours from becoming aware of the breach. What is the most appropriate action for the company?

   • AReport the vendor to the data protection authority for failing to meet the contractual deadline.
   • BAccept the vendor's late notification because the vendor eventually reported the breach.
   • CImmediately terminate the contract with the vendor to avoid future breaches.
   • DAssess whether the company can still meet its regulatory deadline, document the vendor's late notification, and consider contractual remedies.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the purpose of a data processing agreement (DPA) between an organization and a vendor?

   • ATo allow the vendor to use the data for its own business purposes
   • BTo transfer ownership of the personal data to the vendor
   • CTo serve as a marketing document for the vendor's services
   • DTo document the terms and conditions under which the vendor processes personal data on behalf of the organization
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company is conducting due diligence on a potential vendor that will process employee health data for a wellness program. The vendor has provided its privacy policy and a list of sub-processors. What additional information should the company request to complete the due diligence?

   • AThe vendor's financial statements for the past five years.
   • BThe vendor's marketing materials to understand their business model.
   • CThe vendor's employee satisfaction survey results.
   • DThe vendor's data breach response plan and incident notification procedures.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An organization has an ongoing monitoring program for its vendors. During a quarterly review, the organization discovers that a vendor has not updated its privacy policy to reflect new data processing activities. What should the organization do?

   • AIgnore the issue because the privacy policy is not a contractual requirement.
   • BTerminate the contract immediately for non-compliance.
   • CReport the vendor to the data protection authority.
   • DContact the vendor to understand the discrepancy and require an update to the privacy policy to reflect the new activities.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the purpose of ongoing vendor monitoring?

   • ATo ensure the vendor continues to meet privacy requirements throughout the contract term
   • BTo replace the vendor with a new one periodically
   • CTo conduct a one-time assessment before signing the contract
   • DTo audit the vendor's financial records for tax purposes
   Reveal Solution Discussion Select an answer first