3.2 Manage Security Risks Within the Supply Chain (e.g., Supplier, Vendor, Third-Party Risk, Contracts) ISSMP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the purpose of continuous monitoring of supply chain risks?

   • ATo replace the need for periodic risk assessments
   • BTo guarantee that risks are eliminated
   • CTo automate all supplier contract management
   • DTo detect changes in the supply chain risk posture over time
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company is negotiating a contract with a critical supplier that will have access to its intellectual property. The supplier is a small firm with limited resources. The company wants to ensure that the supplier can meet its security obligations without imposing unreasonable costs that could jeopardize the supplier's viability. What is the BEST approach to contractual security requirements?

   • AImpose the company's full security standards on the supplier, regardless of size or resources.
   • BRequire the supplier to obtain ISO 27001 certification within six months.
   • CRely on the supplier's promise to implement security controls without contractual enforcement.
   • DTailor the security requirements to the supplier's risk profile and capabilities, focusing on essential controls and providing a reasonable implementation timeline.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a key component of supply chain security risk objectives?

   • ASpecifying the confidentiality, integrity, and availability requirements for supply chain data and services
   • BListing the names of all approved suppliers
   • CDefining the acceptable level of risk for the supply chain
   • DEnsuring that all suppliers are located in the same geographic region
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of conducting a security audit of a supply chain partner?

   • ATo negotiate better contract terms
   • BTo replace the partner's security controls with the organization's controls
   • CTo verify compliance with security policies and standards
   • DTo determine the partner's profitability
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A government contractor is required to protect classified information and must ensure that its suppliers comply with strict confidentiality requirements. The contractor is negotiating a contract with a new supplier that will handle sensitive data. What is the MOST important security objective to define in the contract?

   • AConfidentiality requirements, including specific data handling and non-disclosure obligations.
   • BCompliance requirements, such as adherence to ISO 27001 standards.
   • CAvailability requirements, ensuring the supplier's systems are operational 99.9% of the time.
   • DIntegrity requirements, ensuring data is not altered during transmission.
   Reveal Solution Discussion Select an answer first