Third-Party and Supply Chain Risk CRISC Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company has a large portfolio of vendors, but only a few are considered critical. The risk team has limited resources. What is the BEST approach to manage vendor risk effectively?

   • AOutsource the entire vendor risk management process to a third party.
   • BOnly assess vendors that have had issues in the past.
   • CConduct comprehensive assessments for critical vendors and use a lighter-touch review for non-critical vendors.
   • DAssess all vendors with the same level of detail to ensure consistency.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the purpose of incident response procedures in vendor relationships?

   • ATo conduct due diligence
   • BTo ensure timely notification and escalation of vendor-related incidents
   • CTo monitor vendor performance
   • DTo negotiate new contracts
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the focus of supply chain risk management?

   • AManaging risks across the entire supply chain
   • BManaging risks of internal operations only
   • CManaging risks of logistics only
   • DManaging risks of a single vendor
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is planning to exit a contract with a vendor that hosts its customer database. The vendor has been uncooperative during the transition, and the company is concerned about data loss. The contract includes a data return clause. What is the BEST approach?

   • AInvoke the data return clause and require the vendor to provide the data in a usable format within a specified timeframe.
   • BThreaten legal action if the vendor does not cooperate.
   • CAccept the risk of data loss and start fresh with a new database.
   • DAsk the vendor to delete the data immediately to avoid any further issues.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is considering a vendor that will handle its payroll processing. The vendor has a strong security posture but has been involved in a lawsuit related to data privacy. What should the company do during due diligence?

   • AReview the details of the lawsuit and assess the potential impact on the vendor's ability to handle payroll data.
   • BIgnore the lawsuit because the vendor has a strong security posture.
   • CAccept the risk because the vendor is the only one that can provide the service.
   • DRequire the vendor to indemnify the company against any future lawsuits.
   Reveal Solution Discussion Select an answer first