3.2 Manage Security Risks Within the Supply Chain (e.g., Supplier, Vendor, Third-Party Risk, Contracts) ISSMP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company's annual supply chain risk review revealed that a key vendor has experienced two security incidents in the past year, and its financial stability is declining. The vendor provides a critical service that is difficult to replace quickly. What should the company do?

   • AUpdate the risk management strategy to include a vendor exit plan and identify alternative suppliers.
   • BContinue with the current vendor and hope that the incidents were isolated.
   • CIncrease the vendor's contractual liability limits to compensate for potential losses.
   • DImmediately terminate the contract with the vendor despite the difficulty of replacement.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the purpose of verifying that security controls implemented by supply chain partners are effective?

   • ATo replace the partner's security team
   • BTo ensure that the controls meet contractual and regulatory requirements
   • CTo guarantee that no security incidents will ever occur
   • DTo identify new business opportunities for the partners
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is an example of an early warning indicator for supply chain risk?

   • AA supplier's marketing campaign launch
   • BA supplier's employee satisfaction survey
   • CA supplier's security incident report
   • DA supplier's quarterly earnings report
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is a key output of a supply chain risk assessment?

   • AA list of all suppliers that must be terminated
   • BA prioritized list of risks based on their likelihood and impact
   • CA guarantee of regulatory compliance
   • DA detailed network diagram of the supplier's infrastructure
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is terminating its contract with a marketing agency that had access to customer data. The company wants to ensure that the agency deletes all data and certifies its deletion. What is the BEST way to manage this termination risk?

   • AAsk the agency to sign a non-disclosure agreement after termination.
   • BInclude a termination clause in the contract that requires data deletion and certification, and verify compliance during the offboarding process.
   • CImmediately revoke the agency's access and assume the data will be deleted.
   • DRely on the agency's verbal assurance that it will delete the data.
   Reveal Solution Discussion Select an answer first