Define Third-Party Vendor Security Requirements CSSLP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A retail company is evaluating a new payment processing vendor. The vendor has passed a security questionnaire, but the company's risk team wants to verify the vendor's actual security controls before finalizing the contract. Which action is the most appropriate due diligence step?

   • AAccept the questionnaire results as sufficient because the vendor has been in business for many years.
   • BRequire the vendor to provide a list of all their customers to check for any past breaches.
   • CWait until after the contract is signed to conduct a security assessment.
   • DRequest and review the vendor's latest penetration test report and any relevant security certifications.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A manufacturing company is evaluating a vendor that will provide IoT device firmware. The vendor claims to have a secure development lifecycle, but the company's security team wants to verify this claim before integration. Which due diligence activity is most appropriate?

   • ARequest the vendor's secure development lifecycle documentation and any third-party assessments of their process.
   • BTrust the vendor's claim because they are a well-known brand in the IoT industry.
   • CWait until after the contract is signed to conduct a security assessment of the vendor.
   • DRequire the vendor to provide a sample of the firmware for the company to test independently.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A government agency is procuring a software development vendor that will handle sensitive but unclassified data. The agency's security requirements mandate that the vendor implement multi-factor authentication (MFA) for all administrative access and undergo background checks for personnel. How should the agency define these requirements in the vendor contract?

   • ARequire the vendor to provide a security plan after the contract is signed, to be approved by the agency.
   • BState that the vendor must follow 'industry best practices' for security.
   • CRely on the vendor's existing security policies, which may already include MFA and background checks.
   • DInclude specific clauses that require MFA for administrative access and background checks for all vendor personnel with access to agency data.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   An organization is defining security requirements for a vendor that will process customer personal data. Which requirement best reflects the organization's compliance needs?

   • AThe vendor must encrypt all personal data in transit and at rest
   • BThe vendor must use the same encryption software as the organization
   • CThe vendor must store data in the organization's own data center
   • DThe vendor must provide a discount for data protection services
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the purpose of ongoing vendor monitoring?

   • ATo transfer all security responsibilities to the vendor
   • BTo continuously assess the vendor's security posture and compliance over time
   • CTo replace the need for initial vendor assessments
   • DTo ensure the vendor's pricing remains competitive
   Reveal Solution Discussion Select an answer first