1.5 Manage Security Requirements in Contracts and Agreements ISSMP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A financial services firm is acquiring a smaller company that uses a different IT infrastructure and has its own security policies. The acquisition is expected to close in 60 days. The security manager is asked to ensure the acquisition does not introduce security risks. What should the security manager do first?

   • ARely on the target company's existing security certifications
   • BWait until the acquisition closes to begin any security review
   • CImmediately enforce the acquiring company's security policies on the target company
   • DConduct a security risk assessment of the target company's infrastructure and policies
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company is considering outsourcing its IT help desk to a third-party provider. The provider's service management agreement includes a low monthly fee but has no mention of security incident response procedures. The company's security team has limited resources. What should the security manager do?

   • AAccept the agreement because the low cost is attractive
   • BRequire the provider to follow the company's internal incident response plan
   • CAsk the provider to provide a separate incident response document after signing
   • DNegotiate to include incident response requirements and procedures in the agreement
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company is acquiring a smaller company that has a history of security incidents. The acquisition agreement includes a clause that requires the target company to remediate all known security issues before the closing date. The target company has missed the remediation deadline. The acquiring company's management wants to proceed with the acquisition because of strategic value. What should the security manager do?

   • AProceed with the acquisition and plan to remediate the issues after closing
   • BDelay the closing until the target company completes the remediation
   • CProceed with the acquisition but reduce the purchase price
   • DProceed with the acquisition and accept the security risks
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is evaluating two cloud service providers. Provider A offers a lower price but has no explicit security controls in its service agreement. Provider B is more expensive but includes detailed security controls and compliance certifications. The company has a limited budget but handles sensitive financial data. What should the security manager recommend?

   • AChoose Provider A to save money and rely on the provider's reputation
   • BChoose Provider A and add security controls later
   • CChoose Provider B but negotiate a lower price by removing some security controls
   • DChoose Provider B because the service agreement includes necessary security controls
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of evaluating the financial implications of a service management agreement from a security perspective?

   • ATo determine the exact cost of every security control implemented by the provider
   • BTo compare the provider's pricing against all competitors in the market
   • CTo calculate the total cost of ownership for the organization's entire IT portfolio
   • DTo ensure that security-related costs and penalties are acceptable and incentivize proper security performance
   Reveal Solution Discussion Select an answer first