What is the purpose of conducting due diligence before entering into a third-party relationship?

To negotiate the lowest possible price

To ensure that the third party uses the same technology stack

To finalize the contract without any changes

To evaluate the third party's security posture and potential risks

A company has implemented a continuous monitoring program for its third-party vendors. The program includes monthly reviews of security metrics and quarterly audits. However, a recent incident at a vendor went undetected for several weeks because the vendor did not report it promptly. What is the MOST likely gap in the monitoring program?

The program relies too heavily on monthly reviews, which are too infrequent to detect incidents.

The program does not include enough technical assessments of the vendor's systems.

The program lacks contractual incident reporting requirements with defined timelines and penalties for non-compliance.

The program does not have a process for terminating vendors that fail to report incidents.

Which of the following is a typical activity in a supply chain security audit?

Reviewing the partner's security policies and procedures

Installing security software on the partner's systems

Designing a new marketing campaign for the partner

Calculating the partner's return on investment

What is the primary purpose of integrating supply chain security risks into the organization's overall risk management framework?

To create a separate risk management framework exclusively for supply chain risks

To ensure that supply chain risks are considered in alignment with the organization's risk appetite and strategic objectives

To eliminate all supply chain risks by terminating contracts with high-risk suppliers

To delegate all supply chain risk decisions to the procurement department

Which of the following is a method for verifying the effectiveness of a supply chain partner's security controls?

Reviewing the partner's security assessment reports

Assuming the partner is secure because they are a large company

Checking the partner's website for security badges

Asking the partner to sign a non-disclosure agreement

Information Systems Security Management Professional

Domain 3Objective 2

3.2 Manage Security Risks Within the Supply Chain (e.g., Supplier, Vendor, Third-Party Risk, Contracts) ISSMP Practice Questions (Page 6)

Part of the Risk Management domain, which accounts for 20% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

10concepts

20%of the exam

Questions 26–30

26foundation · easy
What is the purpose of conducting due diligence before entering into a third-party relationship?
Select an answer first
27expert · hard
A company has implemented a continuous monitoring program for its third-party vendors. The program includes monthly reviews of security metrics and quarterly audits. However, a recent incident at a vendor went undetected for several weeks because the vendor did not report it promptly. What is the MOST likely gap in the monitoring program?
Select an answer first
28foundation · easy
Which of the following is a typical activity in a supply chain security audit?
Select an answer first
29foundation · easy
What is the primary purpose of integrating supply chain security risks into the organization's overall risk management framework?
Select an answer first
30foundation · easy
Which of the following is a method for verifying the effectiveness of a supply chain partner's security controls?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.