CCISO Vendor Management 2

Question 1

A CISO is evaluating third-party vendors for cloud storage services. Which contractual clause BEST ensures the organization retains ownership of its data if the vendor relationship ends?

Accepted Answer

Data portability and return clause

Answer

A data portability and return clause contractually obligates the vendor to return or delete organizational data upon contract termination, ensuring data sovereignty.

Question 2

During a vendor risk assessment, the security team discovers a critical supplier uses the same IT infrastructure for multiple clients with no logical separation. This BEST represents which type of risk?

Accepted Answer

Concentration risk

Answer

Concentration risk arises when a vendor's shared infrastructure creates potential exposure where a breach affecting one client could impact others.

Question 3

Which vendor management practice BEST helps a CISO ensure that security controls implemented by a vendor remain effective over time?

Accepted Answer

Continuous monitoring and periodic re-assessment

Answer

Continuous monitoring and periodic re-assessments ensure vendor security posture does not degrade after initial onboarding approval.

Question 4

An organization shares sensitive PII with a vendor for data analytics. Under GDPR, the vendor processing this data on behalf of the organization is classified as:

Accepted Answer

Data processor

Answer

Under GDPR, an entity that processes personal data on behalf of the controller (the organization) is classified as a data processor.

Question 5

A CISO wants to reduce the impact of a critical vendor going bankrupt. Which strategy is MOST effective for ensuring business continuity?

Accepted Answer

Develop an alternative vendor or escrow arrangement

Answer

Maintaining an alternative vendor or software escrow arrangement ensures continuity of critical services if the primary vendor ceases operations.

(CCISO) EC-Council Certified CISO Practice Test

(CCISO) EC-Council Certified CISO Practice Test

CCISO Vendor Management 2