Third-Party and Supply Chain Risk CRISC Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is a key element of incident response procedures for vendor-related incidents?

   • ASetting performance metrics
   • BDefining notification and escalation paths
   • CReviewing financial statements
   • DConducting vendor audits
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company has a vendor that provides critical software updates. The vendor has been consistently meeting SLAs, but the company's risk team has identified that the vendor's financial stability is declining. The vendor is the only provider of this software. What is the BEST risk response?

   • ATerminate the contract immediately to avoid future issues.
   • BAccept the risk because the vendor has been meeting SLAs.
   • CDevelop a contingency plan that includes identifying alternative solutions and preparing for a potential transition.
   • DIncrease the contract value to help the vendor financially.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is contracting with a vendor for cloud storage services. The company wants to ensure that in the event of a data breach, the vendor will notify the company promptly. Which contractual clause is MOST important?

   • AA clause that requires the vendor to store data only in specific geographic regions.
   • BA clause that allows the company to audit the vendor's security controls.
   • CA service level agreement that guarantees 99.9% uptime.
   • DA data breach notification clause that specifies the timeframe and method of notification.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is an appropriate method for assessing vendor risk?

   • AReviewing the vendor's website
   • BChecking the vendor's social media
   • CAsking for a discount
   • DConducting a vendor questionnaire
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the purpose of ongoing vendor monitoring?

   • ATo negotiate lower prices
   • BTo sign a new contract
   • CTo replace the vendor
   • DTo ensure the vendor continues to meet contractual obligations
   Reveal Solution Discussion Select an answer first