1.5 Manage Security Requirements in Contracts and Agreements ISSMP Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company is considering a merger with a competitor. The competitor has a strong security posture, but the merger will require significant changes to the company's own security infrastructure. The merger agreement includes a clause that requires the combined entity to achieve a certain security certification within one year. The company's security team is concerned about the cost and effort required. What should the security manager do?

   • ANegotiate to extend the timeline for achieving the certification
   • BAccept the clause because the certification is a good goal
   • CReject the merger because of the certification requirement
   • DAccept the clause and plan to achieve the certification without additional resources
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company has a contract with a data processor that includes a clause requiring the processor to comply with all applicable data protection laws. The company's security team has discovered that the processor is not complying with a specific regulation. The contract does not include a specific audit right. What should the security manager do?

   • AConduct an audit of the processor based on the compliance clause
   • BTerminate the contract immediately
   • CRely on the processor's self-reported compliance
   • DIssue a formal notice of non-compliance and require corrective action
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company uses a cloud provider for its production environment. The provider's service agreement includes a clause that allows the provider to change its security controls with 30 days' notice. The company's security team has identified that the provider's new security controls are weaker than the previous ones. The company's management is concerned about the impact on their security posture. What should the security manager do?

   • ARely on the provider's certifications to ensure security
   • BAccept the new controls because the provider has the right to change them
   • CNegotiate to require the provider to maintain a minimum level of security controls
   • DTerminate the contract immediately
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   When evaluating a service management agreement for security alignment, which activity is most directly part of the evaluation process?

   • AAnalyzing the financial penalties and risk exposure tied to security service levels
   • BSelecting the encryption algorithms used for data in transit
   • CTraining the service provider's staff on organizational security policies
   • DConfiguring the service provider's monitoring tools to match internal dashboards
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   How should security be integrated into an outsourcing initiative to manage its security impact?

   • ABy postponing security considerations until after the outsourcing is complete
   • BBy relying on the outsourcing provider's existing security certifications without review
   • CBy including security requirements in the outsourcing contract and conducting risk assessments
   • DBy transferring all security risk to the outsourcing provider
   Reveal Solution Discussion Select an answer first