Which of the following is an example of a contractual security requirement that should be specified in a supplier contract?

The supplier's marketing strategy

The supplier's employee dress code

A financial services firm is onboarding a new payment processing vendor that will handle cardholder data. The vendor operates primarily from a country with a history of state-sponsored cyber espionage. The firm's risk appetite is low for data breaches. What should the security manager do FIRST?

Immediately terminate the onboarding process due to the vendor's geographic location.

Require the vendor to sign a contract with strict data protection clauses and incident reporting obligations.

Conduct a supply chain risk assessment that includes the vendor's geographic location, data access, and service criticality.

Perform a security audit of the vendor's facilities and systems before signing the contract.

What is the primary purpose of conducting a supply chain risk assessment?

To evaluate the likelihood and impact of security threats and vulnerabilities associated with supply chain components

To select the cheapest supplier for each component

To guarantee that no security incidents will occur

To document all supplier contracts

An organization has a contractual right to audit its cloud service provider (CSP) annually. The CSP has provided a recent ISO 27001 certification and a SOC 2 Type II report. The organization wants to verify that the CSP's actual security controls meet its specific requirements. What should the organization do?

Accept the ISO 27001 certification as sufficient evidence of control effectiveness.

Rely on the SOC 2 Type II report as the sole basis for verification.

Conduct its own audit or assessment of the CSP's controls, focusing on the organization's specific requirements.

Request the CSP to provide a letter of attestation from its auditor.

Why is it important to regularly review supply chain security risks and controls?

To ensure that all suppliers are treated equally regardless of risk

To reduce the number of suppliers in the supply chain

To guarantee that no new risks will emerge

To update risk management strategies based on findings and evolving threats

Information Systems Security Management Professional

Domain 3Objective 2

3.2 Manage Security Risks Within the Supply Chain (e.g., Supplier, Vendor, Third-Party Risk, Contracts) ISSMP Practice Questions (Page 5)

Part of the Risk Management domain, which accounts for 20% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

10concepts

20%of the exam

Questions 21–25

21foundation · easy
Which of the following is an example of a contractual security requirement that should be specified in a supplier contract?
Select an answer first
22application · medium
A financial services firm is onboarding a new payment processing vendor that will handle cardholder data. The vendor operates primarily from a country with a history of state-sponsored cyber espionage. The firm's risk appetite is low for data breaches. What should the security manager do FIRST?
Select an answer first
23foundation · easy
What is the primary purpose of conducting a supply chain risk assessment?
Select an answer first
24application · medium
An organization has a contractual right to audit its cloud service provider (CSP) annually. The CSP has provided a recent ISO 27001 certification and a SOC 2 Type II report. The organization wants to verify that the CSP's actual security controls meet its specific requirements. What should the organization do?
Select an answer first
25foundation · easy
Why is it important to regularly review supply chain security risks and controls?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.