Define Third-Party Vendor Security Requirements CSSLP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A financial services firm is engaging a cloud-based payroll provider. The firm's security policy requires encryption of all sensitive data both in transit and at rest, and mandates that the provider notify the firm within 24 hours of any security incident. The procurement team is drafting the contract. Which approach best defines the vendor security requirements?

   • AInclude specific encryption standards (e.g., TLS 1.2+ for transit, AES-256 for at rest) and a 24-hour incident notification clause in the contract.
   • BAsk the vendor to provide a security whitepaper and accept it as the basis for the contract.
   • CRequire the vendor to undergo a penetration test after the contract is signed, with results shared internally.
   • DRely on the vendor's standard terms and conditions, assuming they meet industry best practices.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A healthcare organization is integrating a third-party analytics platform that will process de-identified patient data. The vendor's security questionnaire indicates they have SOC 2 Type II certification, but the organization's security team has not yet reviewed the actual report. The compliance officer insists on verifying the vendor's controls before signing. Which action best addresses the vendor risk assessment requirement?

   • AConduct a full on-site audit of the vendor's facilities before any data is shared.
   • BRequire the vendor to sign a contract clause indemnifying the organization against any data breach.
   • CRequest and review the vendor's SOC 2 Type II report, focusing on controls relevant to data processing and confidentiality.
   • DAccept the SOC 2 Type II certification as sufficient evidence of compliance because it is a widely recognized standard.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of conducting a vendor security assessment?

   • ATo establish a long-term business relationship with the vendor
   • BTo determine the vendor's market share
   • CTo negotiate better pricing with the vendor
   • DTo verify that the vendor complies with the defined security requirements
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company is contracting with a vendor that will host a customer portal containing personal data. The company wants to ensure that the vendor's security controls are audited regularly and that any findings are shared with the company. Which contractual clause is most appropriate?

   • AA clause stating that the vendor will comply with all applicable data protection laws.
   • BA right-to-audit clause that allows the company to review the vendor's security controls and requires the vendor to share audit findings.
   • CA clause requiring the vendor to maintain a public security page that lists all past security incidents.
   • DA clause that requires the vendor to purchase cybersecurity insurance and provide proof of coverage annually.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   An organization is considering a vendor that will provide a software component used in its customer-facing application. Which activity best exemplifies a third-party vendor risk assessment?

   • AComparing the vendor's pricing against two other vendors
   • BDrafting a non-disclosure agreement for the vendor to sign
   • CScheduling a meeting to discuss the vendor's product roadmap
   • DReviewing the vendor's security certifications and past incident history
   Reveal Solution Discussion Select an answer first