Which of the following should trigger a review of supply chain risk management strategies?

A significant security incident involving a supplier

The supplier's annual holiday party

A change in the supplier's office location

When defining security risk objectives for the supply chain, which of the following is the primary purpose of articulating these objectives?

To document the security controls that each supplier must implement

To ensure that all suppliers use the same security controls as the organization

To establish a clear statement of the desired security outcomes and requirements for the supply chain

To transfer all security risks to the suppliers through contractual agreements

Which of the following is a key element of third-party risk management?

Transferring all risks to the third party

One-time assessment at the start of the relationship

Avoiding all third-party relationships

Ongoing monitoring of the third party's security posture

A large enterprise has a risk appetite that allows for moderate risk in non-critical functions but requires low risk for critical business processes. The enterprise is considering a new supplier for its customer relationship management (CRM) system, which is critical to sales operations. The supplier is innovative but has a shorter track record and less mature security program. How should the enterprise integrate this supply chain risk into its overall risk management framework?

Reject the supplier solely because its security program is less mature.

Perform a risk assessment and compare the supplier's risk level against the lower risk appetite for critical processes, then decide if additional controls or acceptance is appropriate.

Treat the supplier as a non-critical vendor because it is a CRM system, not a core infrastructure.

Accept the supplier because the enterprise's overall risk appetite is moderate.

When identifying supply chain risks, which factor is most relevant to categorize the risk introduced by a supplier?

The supplier's geographic location

The supplier's marketing budget

The supplier's brand color scheme

The supplier's office furniture

Information Systems Security Management Professional

Domain 3Objective 2

3.2 Manage Security Risks Within the Supply Chain (e.g., Supplier, Vendor, Third-Party Risk, Contracts) ISSMP Practice Questions (Page 2)

Part of the Risk Management domain, which accounts for 20% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

10concepts

20%of the exam

Questions 6–10

6foundation · easy
Which of the following should trigger a review of supply chain risk management strategies?
Select an answer first
7foundation · easy
When defining security risk objectives for the supply chain, which of the following is the primary purpose of articulating these objectives?
Select an answer first
8foundation · easy
Which of the following is a key element of third-party risk management?
Select an answer first
9expert · hard
A large enterprise has a risk appetite that allows for moderate risk in non-critical functions but requires low risk for critical business processes. The enterprise is considering a new supplier for its customer relationship management (CRM) system, which is critical to sales operations. The supplier is innovative but has a shorter track record and less mature security program. How should the enterprise integrate this supply chain risk into its overall risk management framework?
Select an answer first
10foundation · easy
When identifying supply chain risks, which factor is most relevant to categorize the risk introduced by a supplier?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.