Participate in the Technology Procurement Management ISSEP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A university is procuring a learning management system (LMS). The contract requires the vendor to deliver source code escrow and a vulnerability disclosure policy. During the review of contractual deliverables, the security team finds that the source code escrow agreement is missing. What should the security team do?

   • AReject the deliverable and request the missing escrow agreement before accepting the LMS
   • BAsk the vendor to provide a verbal assurance instead
   • CAccept the LMS and note the missing agreement for later
   • DAssume the escrow is not important because the vendor is stable
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A retail company is acquiring a new point-of-sale (POS) system. The security team has defined requirements for encryption of cardholder data and role-based access control. During the selection process, a vendor proposes a solution that stores cardholder data in a centralized cloud database. What additional security requirement should be added to the acquisition documentation?

   • AA requirement for the vendor to use the latest marketing buzzwords
   • BA requirement for the vendor to provide free training
   • CData segmentation and tokenization to limit the scope of PCI DSS compliance
   • DA requirement for the vendor to use a specific brand of hardware
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary benefit of using a structured selection process when evaluating technology solutions?

   • AIt ensures the solution with the most features is selected
   • BIt provides a consistent, repeatable method to compare solutions against security and organizational requirements
   • CIt speeds up the procurement process by skipping security testing
   • DIt guarantees the selected solution will be free of all security vulnerabilities
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is a key step in a structured technology selection process?

   • ADefining evaluation criteria based on security requirements and organizational needs
   • BSelecting the solution with the lowest total cost of ownership
   • CChoosing the solution that is most popular in the industry
   • DDeferring security evaluation until after the purchase is complete
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A multinational corporation is selecting a new video conferencing platform. The security team has defined requirements for end-to-end encryption and compliance with GDPR. Vendor A offers end-to-end encryption but stores data in the US. Vendor B offers standard encryption and stores data in the EU. The corporation has offices in both regions. What is the most appropriate decision?

   • ADefer the decision until a vendor can meet all requirements
   • BRequire Vendor A to provide EU data residency while maintaining end-to-end encryption
   • CSelect Vendor A because end-to-end encryption is a stronger security control
   • DSelect Vendor B because EU data residency ensures GDPR compliance
   Reveal Solution Discussion Select an answer first