1.11 - Apply Supply Chain Risk Management (SCRM) Concepts CISSP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A retail company outsources its payment processing to a third-party provider. The company wants to ensure that the provider maintains adequate security and availability. Which document should the company include in the contract to specify measurable expectations for security and uptime?

   • AA business associate agreement (BAA) that addresses HIPAA compliance.
   • BA data processing agreement (DPA) that covers data protection responsibilities.
   • CService level requirements (SLRs) that define security controls and availability targets.
   • DA memorandum of understanding (MOU) that outlines a general partnership.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A healthcare organization is procuring a new patient-management system from a software vendor. The vendor's product includes several third-party libraries. The organization's security team wants to ensure that any known vulnerabilities in these libraries are identified before deployment and that the vendor is held accountable for maintaining them. Which two actions should the security team take?

   • ARequest a copy of the vendor's penetration test report and perform a vulnerability scan of the vendor's network.
   • BRequire the vendor to use a specific encryption algorithm and mandate multi-factor authentication for all users.
   • CRequire a software bill of materials (SBOM) and include a contractual clause for timely patching of third-party components.
   • DConduct a physical inspection of the vendor's data center and require background checks for all vendor employees.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company has a contract with a cloud provider that includes service level requirements (SLRs) for availability. The provider has experienced several outages, and the company wants to ensure the provider is held accountable. What should the company do?

   • AAsk the provider to provide a discount on future services.
   • BIgnore the outages because SLRs are not legally binding.
   • CTerminate the contract immediately and find a new provider.
   • DReview the SLRs and enforce penalties or credits for missed targets, and consider additional monitoring to verify compliance.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary purpose of conducting third-party assessments of suppliers?

   • ATo verify that suppliers meet the organization's security requirements
   • BTo ensure suppliers use the same software as the organization
   • CTo transfer all security liability to the supplier
   • DTo negotiate lower prices for products and services
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company is considering using a third-party software component in its product. The company wants to assess the risk of using this component. Which document would provide the most useful information for this assessment?

   • AThe component's license agreement
   • BThe component's marketing brochure
   • CThe component's user manual
   • DThe software bill of materials (SBOM) for the component
   Reveal Solution Discussion Select an answer first