Define Third-Party Vendor Security Requirements CSSLP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which contractual clause is intended to hold a vendor financially responsible for damages resulting from a security breach?

   • AService level agreement (SLA)
   • BNon-disclosure agreement (NDA)
   • CLiability clause
   • DIndemnification clause
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company is contracting with a vendor that will process sensitive financial data. The vendor has a history of minor security incidents but has always resolved them quickly. The company's legal team wants to include a clause that holds the vendor liable for any breach, but the vendor is resistant to unlimited liability. The company also wants to ensure ongoing monitoring of the vendor's security. What is the most balanced contractual approach?

   • AInclude a liability cap that is proportional to the risk, along with a right-to-audit clause and requirements for incident reporting.
   • BAccept the vendor's standard liability terms without negotiation.
   • CRequire the vendor to purchase cybersecurity insurance and waive any liability for incidents.
   • DInsist on unlimited liability, even if it means the vendor may not sign the contract.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company is outsourcing its software testing to a vendor that will have access to production data. The company's security policy requires that all data be encrypted, and the compliance team requires that the vendor be able to demonstrate compliance with the company's security requirements. The vendor has proposed using its own encryption standards, which differ from the company's. What is the best way to define the vendor security requirements?

   • ARequire the vendor to use the company's encryption tools and infrastructure.
   • BAccept the vendor's encryption standards because they are likely to be industry-standard.
   • CPostpone the decision until after the contract is signed and the vendor's encryption is tested.
   • DNegotiate a contract that specifies the company's encryption standards and requires the vendor to demonstrate compliance through regular assessments.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which activity is part of ongoing vendor management?

   • AConducting a one-time security assessment at contract signing
   • BPeriodically reviewing the vendor's security certifications and incident reports
   • CTerminating the contract if any issue is found
   • DSending the vendor a list of new product features
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company has an existing contract with a vendor that provides customer support software. The vendor recently announced a change in their data storage location to a different country. The company's security team is concerned about the impact on data residency and compliance. What is the most appropriate action?

   • AAsk the vendor to sign a new contract with the same terms as before.
   • BImmediately terminate the contract because the data storage location changed.
   • CReview the contract for any clauses that require notification of such changes and assess the new location's compliance implications.
   • DIgnore the change because the vendor is still the same company.
   Reveal Solution Discussion Select an answer first