3.2 Manage Security Risks Within the Supply Chain (e.g., Supplier, Vendor, Third-Party Risk, Contracts) ISSMP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company's supply chain risk review has identified that a long-standing vendor's security posture has declined significantly due to financial difficulties. The vendor provides a critical component with no readily available alternative. The company's risk appetite is low for critical components. What is the BEST course of action?

   • AAccept the risk because the vendor has been reliable in the past.
   • BDevelop a risk mitigation plan that includes increased monitoring, contractual penalties for security lapses, and a contingency plan for alternative sourcing.
   • CIncrease the vendor's contractual liability limits to compensate for potential losses.
   • DImmediately terminate the contract and find a new supplier, even if it means production delays.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company is planning to audit a critical vendor that provides cloud infrastructure services. The vendor has multiple data centers in different countries, and the company's audit team is based in a different region. The company wants to verify the vendor's compliance with its security requirements, but the audit must be completed within a limited budget. What is the MOST effective audit strategy?

   • AAudit only the data center that hosts the company's data, ignoring the others.
   • BConduct a remote audit using a combination of documentation review, interviews, and technical testing of the vendor's systems.
   • CRely solely on the vendor's SOC 2 Type II report and skip the audit.
   • DPerform an on-site audit of all the vendor's data centers to ensure comprehensive coverage.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A retail company has outsourced its customer support to a third-party call center. The company wants to ensure that the call center's security posture remains acceptable over time. Which approach BEST supports continuous monitoring of this third-party risk?

   • AEstablish key performance indicators (KPIs) and early warning indicators that are reviewed monthly with the call center.
   • BRely on the call center's annual self-assessment report.
   • CConduct a comprehensive security audit of the call center every two years.
   • DInclude a contractual clause requiring the call center to notify the company of any security incident.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A manufacturing company relies on a single supplier for a critical component used in its main product. The supplier is located in a politically unstable region. The company's risk management framework requires that all risks be assessed in terms of likelihood and impact. What should the risk manager do to assess this supply chain risk?

   • AEvaluate the likelihood of supply disruption and the impact on production and revenue if the supplier fails.
   • BImmediately seek an alternative supplier to eliminate the risk of disruption.
   • CRequire the supplier to sign a contract guaranteeing supply continuity.
   • DAdd the supplier to the company's risk register without further analysis.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company's contract with a software vendor requires the vendor to implement specific security controls, including encryption of data at rest and in transit. The company wants to validate that these controls are actually in place. What is the MOST effective method?

   • AReview the vendor's marketing materials that describe their security features.
   • BAccept the vendor's annual self-certification of compliance.
   • CRely on the vendor's ISO 27001 certification as proof of encryption controls.
   • DPerform a technical assessment or penetration test of the vendor's application and infrastructure.
   Reveal Solution Discussion Select an answer first