1.5 Manage Security Requirements in Contracts and Agreements ISSMP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company has contracted with a cloud provider for infrastructure services. The contract includes a service level agreement (SLA) for uptime but no security monitoring requirements. The company's security team wants to ensure the provider's security posture is maintained. What should the security manager do?

   • AConduct a one-time security assessment of the provider
   • BAdd security monitoring and reporting requirements to the contract
   • CRely on the provider's uptime SLA as a proxy for security
   • DAsk the provider to share its internal security reports voluntarily
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company has outsourced its network monitoring to a managed security service provider (MSSP). The MSSP provides monthly reports, but the company's security team has noticed that the reports are delayed and lack detail on critical alerts. The contract does not specify reporting timelines or content. What should the security manager do?

   • AConduct a one-time audit of the MSSP's operations
   • BTerminate the contract immediately and bring monitoring in-house
   • CAccept the reports as they are since the MSSP is the expert
   • DRenegotiate the contract to include specific reporting requirements and service level agreements
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which activity is used to monitor compliance with a service management agreement?

   • AUpdating the organization's internal security policies
   • BConducting periodic security audits of the provider's operations
   • CRenegotiating the contract terms annually
   • DReviewing the provider's marketing materials
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which mechanism is most directly used to govern a managed services provider's security performance?

   • AReplacing the provider's security team with internal staff
   • BRequiring the provider to use the same security tools as the organization
   • CRegular security reviews and audits of the provider's controls and processes
   • DTransferring all security liability to the provider through insurance
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is a key element of governance for managed cloud services?

   • ADefining clear security roles, responsibilities, and accountability for both the organization and the provider
   • BEliminating the need for internal security monitoring
   • CDelegating all security decisions to the cloud provider
   • DEnsuring the provider has no access to the organization's data
   Reveal Solution Discussion Select an answer first