Sourcing Strategies CGEIT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company has selected a vendor for a new IT project. During the due diligence phase, the company discovered that the vendor has had several data breaches in the past two years. However, the vendor has provided a detailed remediation plan and has achieved a new security certification. What should the company do?

   • AConduct a more detailed security assessment of the vendor's remediation plan and controls
   • BProceed with the vendor since they have a remediation plan and a new certification
   • CProceed with the vendor but require a higher level of liability insurance
   • DReject the vendor immediately due to the history of data breaches
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A startup with a small IT team needs to launch a new customer-facing web application quickly. The team has no experience running production servers, and the company wants to avoid large upfront capital expenditures. The application's usage is expected to be highly variable. Which sourcing strategy is the most appropriate for this startup?

   • ACo-sourcing where the startup's developers write code and a local firm provides the physical servers
   • BInsourcing by hiring a dedicated infrastructure team and building an on-premises data center
   • COutsourcing to a managed service provider that will host and operate the application on dedicated hardware
   • DUsing a public cloud provider with a platform-as-a-service (PaaS) offering
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company is about to sign a contract with a new IT vendor. The vendor has provided a draft SLA that includes performance metrics, but the company's legal team has noted that the SLA does not include any provisions for data security audits. The company handles sensitive customer data. What should the company do before signing the contract?

   • AReject the vendor and start the RFP process again
   • BSign the contract and conduct an independent security audit of the vendor after the contract is signed
   • CNegotiate to include a right-to-audit clause in the SLA
   • DSign the contract and rely on the vendor's reputation for security
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Before selecting a sourcing strategy, an organization compares the total costs of each option against the expected benefits. Which decision criterion does this represent?

   • ACost-benefit analysis
   • BOrganizational culture
   • CVendor reputation
   • DRegulatory compliance
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   An organization's sourcing arrangement must comply with data protection regulations. Which aspect of sourcing governance does this requirement address?

   • ACost reduction
   • BCompliance
   • CScalability
   • DVendor selection
   Reveal Solution Discussion Select an answer first