Vendor and Supply Chain Management CDPSE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the main purpose of including contractual privacy requirements in a vendor contract?

   • ATo ensure the vendor uses the latest technology for data processing
   • BTo document the vendor's marketing strategies for personal data use
   • CTo legally obligate the vendor to handle personal data in accordance with the organization's privacy policies and applicable laws
   • DTo transfer all liability for data breaches to the vendor
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company is drafting a contract with a data analytics vendor. The company wants to ensure that the vendor cannot use the data for its own purposes. Which contractual clause is most appropriate?

   • AA clause allowing the vendor to use aggregated data for benchmarking purposes.
   • BA clause requiring the vendor to implement multi-factor authentication for access to the data.
   • CA clause stating that the vendor may only process personal data for the purposes specified in the contract.
   • DA clause requiring the vendor to store data in a specific geographic location.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is a key input to a vendor privacy risk assessment?

   • AThe vendor's stock price and quarterly earnings report
   • BThe vendor's marketing budget and advertising strategy
   • CThe vendor's office location and employee count
   • DThe vendor's data processing activities and the types of personal data involved
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the primary purpose of establishing incident response and breach notification procedures for vendors?

   • ATo document the vendor's marketing strategies for personal data use
   • BTo ensure that privacy incidents are reported to the organization in a timely manner so that it can respond appropriately
   • CTo prevent any privacy incidents from ever occurring
   • DTo shift all responsibility for incident response to the vendor
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company's primary vendor for customer relationship management (CRM) services intends to engage a sub-processor to handle data analytics. The company's DPA with the vendor requires prior written consent for sub-processor changes. What should the company do?

   • AReview the sub-processor's privacy and security practices and then decide whether to grant consent.
   • BAutomatically grant consent because the primary vendor is responsible for the sub-processor's actions.
   • CRequire the vendor to sign an amended DPA that removes the consent requirement.
   • DObject to any sub-processor engagement to avoid additional risk.
   Reveal Solution Discussion Select an answer first