Define Third-Party Vendor Security Requirements CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A software company is contracting with a third-party QA vendor that will have access to production-like test data, including synthetic personal information. The company's legal team wants to ensure the vendor is liable for data breaches and that the vendor's subcontractors are also covered. Which contractual clause is most critical to include?

   • AA clause requiring the vendor to carry cybersecurity insurance, with the company named as an additional insured.
   • BA clause stating the vendor will comply with all applicable laws and regulations.
   • CA non-disclosure agreement (NDA) that prohibits the vendor from disclosing any information about the project.
   • DA data protection addendum that includes liability for breaches, flow-down clauses to subcontractors, and data handling requirements.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company has signed a contract with a cloud infrastructure vendor that includes a requirement for the vendor to maintain a certain security baseline. The company's security team wants to ensure the vendor continues to meet these requirements over time. What is the most effective way to establish ongoing vendor monitoring?

   • ARequire the vendor to provide a monthly report of all security incidents, but do not review them.
   • BRely on the vendor's public security certifications, assuming they remain valid indefinitely.
   • CConduct a one-time comprehensive audit and then close the monitoring process.
   • DSchedule annual security reviews and require the vendor to report any material security changes or incidents promptly.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A software development firm is considering a third-party code library that will be integrated into a customer-facing application. The library is open-source and widely used, but the firm's security team is concerned about potential vulnerabilities and the maintenance status of the project. What is the most appropriate initial step in assessing this third-party risk?

   • AAsk the library's original developers for a security audit report.
   • BImmediately replace the library with a custom-built component to avoid any third-party risk.
   • CPerform a vulnerability scan and review the library's maintenance history and community activity.
   • DAssume the library is safe because it is widely used and popular.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which activity is part of vendor due diligence?

   • AScheduling a social event for the vendor team
   • BRequesting a discount on the vendor's services
   • CReviewing the vendor's security policies and audit reports
   • DAsking the vendor to provide a list of their customers
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In a vendor contract, which clause is specifically designed to address data protection obligations?

   • AA clause defining the payment schedule for services
   • BA clause outlining the vendor's employee training program
   • CA clause specifying how the vendor must handle and protect personal data
   • DA clause describing the vendor's marketing strategy
   Reveal Solution Discussion Select an answer first