Define Third-Party Vendor Security Requirements CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A multinational corporation is integrating a third-party customer relationship management (CRM) system that will store personal data of customers in multiple jurisdictions. The corporation's security team must assess the vendor's risk, but the vendor has different security certifications for different regions. The compliance team requires that data residency be maintained within specific countries. What is the most comprehensive approach to this vendor risk assessment?

   • AAccept the vendor's global security certification as sufficient for all regions.
   • BEvaluate the vendor's certifications and controls for each region, and map them against the corporation's data residency and compliance requirements.
   • CRequire the vendor to store all data in the corporation's home country, regardless of customer location.
   • DConduct a single comprehensive audit of the vendor's headquarters and apply the results to all regions.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company has a long-term contract with a vendor that provides a critical software component. The vendor's security posture has been stable, but the company's security team is concerned about the vendor's recent acquisition by another company. The acquisition may change the vendor's security policies and personnel. What is the most appropriate action for ongoing vendor monitoring?

   • ARequire the vendor to re-sign the original contract with the same terms.
   • BConduct a focused reassessment of the vendor's security posture, including reviewing any changes in policies, personnel, and incident response capabilities.
   • CTerminate the contract immediately because the vendor has been acquired.
   • DContinue with the existing monitoring schedule, as the vendor's security posture has been stable.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   When defining security requirements for a third-party vendor, what is the most important characteristic of these requirements?

   • AThey are clear and measurable
   • BThey are based on the vendor's preferences
   • CThey are limited to data protection
   • DThey are identical for all vendors
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company is evaluating a vendor that will provide a critical component of its software supply chain. The vendor has passed a security questionnaire, but the company's security team has limited resources and cannot conduct a full on-site audit. The vendor is located in a different country, and the company has no prior relationship with them. What is the most effective due diligence approach given these constraints?

   • ADefer the due diligence until after the contract is signed, when more resources may be available.
   • BReview the vendor's security certifications, request a copy of their latest penetration test report, and conduct a remote interview with their security team.
   • CRely solely on the security questionnaire because it is the vendor's self-assessment.
   • DConduct a full on-site audit despite the resource constraints, as it is the only way to verify security.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   During the requirements phase for a new software system, the organization plans to integrate a third-party authentication service. What is the primary purpose of performing a third-party vendor risk assessment?

   • ATo ensure the vendor uses the same technology stack as the organization
   • BTo negotiate the lowest possible purchase price for the vendor's services
   • CTo identify and evaluate the security risks the vendor introduces to the software supply chain
   • DTo transfer all liability for security incidents to the vendor
   Reveal Solution Discussion Select an answer first