Management of Contracted Services and Relationships CGEIT Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company is outsourcing its data backup and recovery services. The vendor is located in a different country with different data protection laws. The company's risk assessment identifies a risk that the vendor may not be able to recover data in a timely manner during a disaster. The company's business continuity plan requires a recovery time objective (RTO) of 4 hours. What should the company do?

   • AAccept the risk because the vendor is reputable.
   • BIncrease the RTO to 24 hours to make it easier for the vendor to comply.
   • CInclude a contractual requirement for the vendor to meet the RTO and conduct regular recovery tests.
   • DChoose a vendor in the same country to avoid legal issues.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An organization is terminating a contract with an IT services vendor due to poor performance. The organization wants to transition to a new vendor, but the outgoing vendor is reluctant to cooperate, citing confidentiality concerns. The organization needs to ensure a smooth transition without losing critical knowledge. What should the organization do?

   • AInvoke the exit management clause in the contract to require cooperation and knowledge transfer.
   • BAccept the vendor's refusal and start fresh with the new vendor.
   • CThreaten legal action if the vendor does not cooperate.
   • DAsk the new vendor to obtain the knowledge independently.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which element is typically negotiated in an IT services contract?

   • AService levels
   • BEmployee training schedules
   • COffice furniture selection
   • DInternal project management methodology
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is outsourcing its payroll processing to a third-party provider. The provider will have access to sensitive employee data. The company's risk assessment identifies data breach and service disruption as key risks. What should the company include in the contract to mitigate these risks?

   • ADetailed security requirements, business continuity plans, and audit rights.
   • BA requirement for the provider to use subcontractors for redundancy.
   • CA clause that limits the provider's liability to the contract value.
   • DA clause requiring the provider to maintain cyber insurance.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A financial services firm is evaluating whether to outsource its IT help desk. The firm's strategic plan emphasizes cost reduction and rapid scalability during peak trading seasons, but regulatory requirements mandate strict data protection for customer records. The vendor shortlist includes a low-cost offshore provider and a more expensive domestic provider with a strong compliance track record. Which approach best aligns the contracting strategy with the enterprise goals?

   • ASelect the offshore provider because cost reduction is the primary strategic goal.
   • BDefer the decision until the regulatory environment changes to allow offshore processing.
   • CSelect the domestic provider because compliance is the only relevant factor.
   • DConduct a formal vendor selection process that weighs cost, scalability, and compliance against the firm's risk appetite.
   Reveal Solution Discussion Select an answer first