Acquisition of Resources CGEIT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of evaluating vendors against a defined set of criteria?

   • ATo select the vendor that best meets the enterprise's requirements and minimizes risk
   • BTo negotiate the lowest possible price
   • CTo justify the need for the acquisition
   • DTo determine the total cost of ownership after the contract is signed
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A healthcare organization is evaluating two vendors for a new electronic health record (EHR) system. Vendor A has a lower upfront cost but a weaker track record in data security and has experienced two public breaches in the past year. Vendor B has a higher cost but strong security certifications and a proven implementation record in similar organizations. The organization has strict regulatory compliance requirements. Which vendor should the organization select?

   • AEither vendor, as long as the contract includes a strong service level agreement (SLA).
   • BVendor A, because the lower cost allows more budget for security enhancements.
   • CVendor B, because its security posture and implementation experience align better with regulatory and risk requirements.
   • DVendor A, but require a third-party security audit before go-live.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A retail company is acquiring a new point-of-sale (POS) system. The project team has identified that the vendor's implementation timeline is aggressive and may not allow sufficient time for user acceptance testing (UAT). The system is critical for holiday sales. What is the best way to manage this risk?

   • AAsk the vendor to provide additional training to compensate for the lack of testing.
   • BAccept the risk and plan for manual workarounds if the system fails.
   • CNegotiate a phased implementation that allows UAT before the holiday season.
   • DSkip UAT to meet the go-live date.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A multinational corporation is procuring a cloud-based collaboration suite. The legal team has identified that the vendor's data processing terms do not fully comply with the General Data Protection Regulation (GDPR) requirements for international data transfers. The IT governance leader must ensure compliance. What should the leader do?

   • ARequire the vendor to sign standard contractual clauses (SCCs) or provide an equivalent legal mechanism for data transfers.
   • BStore all data in the vendor's US data centers to simplify compliance.
   • CProceed with the acquisition because the vendor is a well-known global provider.
   • DAsk the vendor to delete all personal data after one year.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An enterprise is negotiating a contract for a new data analytics platform. The vendor's standard contract includes a clause that limits liability to the amount paid for the software. The enterprise's legal team is concerned about data breaches and wants to ensure the vendor is accountable for security incidents. What should the IT governance leader do?

   • ANegotiate a higher liability cap or an exception for data breaches and security incidents.
   • BRely on cyber insurance to cover any losses from a data breach.
   • CRequire the vendor to provide a performance bond.
   • DAccept the liability limitation because it is standard in the industry.
   Reveal Solution Discussion Select an answer first