Third-Party and Supply Chain Risk CRISC Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company is assessing a vendor that will provide marketing services and will have access to customer email addresses. The vendor is a small firm with limited security resources. What is the MOST appropriate assessment method?

   • AConduct a security questionnaire and review the vendor's security policies and procedures.
   • BSkip the assessment because the vendor is small and unlikely to be a target.
   • CRequire the vendor to obtain a penetration test report before proceeding.
   • DPerform a full on-site audit of the vendor's facilities.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company's payment processing vendor has experienced a data breach that may have exposed customer credit card information. The vendor has notified the company. What should the risk practitioner do FIRST?

   • AActivate the incident response plan and coordinate with the vendor to contain the breach and assess impact.
   • BTerminate the contract with the vendor.
   • CWait for the vendor to provide a full report before taking any action.
   • DNotify all affected customers immediately.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company has a vendor that provides critical infrastructure services. The vendor has been experiencing financial difficulties, which could impact service delivery. What should the risk practitioner do to monitor this risk?

   • AIgnore the financial issues because the vendor has been reliable in the past.
   • BReview the vendor's financial health on a regular basis, such as quarterly, and track key risk indicators.
   • CTerminate the contract immediately due to financial risk.
   • DWait for the vendor to report any financial issues.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the purpose of vendor due diligence?

   • ATo monitor vendor performance
   • BTo negotiate the best price
   • CTo establish a service level agreement
   • DTo evaluate the vendor's financial stability and security posture
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company is contracting with a cloud provider to host a critical application. The provider has a history of minor service disruptions. The company wants to ensure that if the provider fails to meet performance targets, the company can recover costs and potentially exit the contract. Which contractual clause is MOST important to include?

   • AA clause requiring the provider to use subprocessors approved by the company.
   • BAn indemnification clause for third-party claims.
   • CA confidentiality clause to protect the company's data.
   • DA service level agreement (SLA) with penalties and a right to terminate for repeated breaches.
   Reveal Solution Discussion Select an answer first