Participate in the Technology Procurement Management ISSEP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A hospital is procuring a new patient monitoring system. The security team has defined requirements for encryption of patient data in transit and at rest, and for audit logging. The vendor proposes a solution that uses a proprietary encryption algorithm. What should the security team do?

   • ARequire the vendor to publish the algorithm's source code
   • BReject the proprietary algorithm and require the use of a standardized, validated encryption algorithm
   • CAsk the vendor to provide a white paper on the algorithm
   • DAccept the proprietary algorithm because the vendor claims it is secure
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A logistics company is procuring GPS tracking devices for its fleet. The devices rely on a third-party cloud service for data processing. The security team is concerned about the third-party service's data retention practices. What should the security team do during the procurement process?

   • AIgnore the concern because the third-party service is well-known
   • BAsk the third-party service to provide a verbal commitment
   • CAssume the third-party service will delete data automatically
   • DInclude a contractual requirement for the third-party service to comply with the company's data retention policy
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is an example of a supply chain risk that should be assessed during technology procurement?

   • AThe supplier sources components from a region with a high risk of counterfeit electronics
   • BThe supplier's product documentation is written in a language the organization's staff cannot read
   • CThe supplier's product has a user interface that is difficult for employees to navigate
   • DThe supplier's development team uses an agile software development methodology
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A government agency is selecting a new endpoint detection and response (EDR) tool. The security team has defined mandatory requirements: support for Windows and Linux, integration with the existing SIEM, and on-premises deployment. Three vendors meet these requirements. What should the agency do next in the structured selection process?

   • AChoose the vendor with the lowest price
   • BEvaluate each vendor against additional weighted criteria such as performance, usability, and support
   • CSelect the vendor with the largest market share
   • DDefer the decision until a new requirement emerges
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A defense contractor is procuring a new cloud-based collaboration suite. The security team has documented requirements for data-at-rest encryption, multi-factor authentication, and audit logging. During the selection process, two vendors meet these baseline requirements. Vendor A offers a lower price but stores data in a country with different data protection laws. Vendor B is more expensive but offers a dedicated region in the contractor's home country. Which additional security requirement should the contractor prioritize in the selection decision?

   • AEase of user adoption
   • BData residency and sovereignty compliance
   • CLower total cost of ownership
   • DVendor's marketing reputation
   Reveal Solution Discussion Select an answer first