CCISO Vendor Management 3

Question 1

A CISO is implementing a tiered vendor classification model. Which factor MOST heavily influences placing a vendor in the highest-risk tier?

Accepted Answer

Volume and sensitivity of data accessed and criticality to business operations

Answer

The highest-risk tier classification is driven primarily by the sensitivity of data the vendor accesses and how critical their service is to core business operations.

Question 2

Which of the following is the PRIMARY purpose of including a right-to-audit clause in a vendor contract?

Accepted Answer

To allow the organization to verify vendor compliance with security requirements

Answer

A right-to-audit clause grants the organization the contractual authority to assess whether the vendor is adhering to agreed security and compliance obligations.

Question 3

A fourth-party risk scenario occurs when:

Accepted Answer

A vendor's own subcontractor causes a breach affecting your organization

Answer

Fourth-party risk occurs when a vendor's supplier or subcontractor (a party not directly contracted by you) causes a security incident affecting your organization.

Question 4

During contract negotiations, a vendor refuses to accept liability for data breaches caused by their negligence. A CISO should PRIMARILY:

Accepted Answer

Seek legal counsel and consider alternative vendors

Answer

Accepting zero vendor liability for negligence-caused breaches transfers all risk to the organization; the CISO should involve legal counsel and evaluate alternatives.

Question 5

An organization's vendor sends a notice that they have suffered a ransomware attack and may not be able to deliver services. Which vendor management document MOST directly guides the organization's immediate response?

Accepted Answer

Business continuity and incident response provisions in the vendor contract

Answer

Contract provisions covering incident notification, business continuity, and escalation procedures directly govern the organization's response to a vendor security incident.

(CCISO) EC-Council Certified CISO Practice Test

(CCISO) EC-Council Certified CISO Practice Test

CCISO Vendor Management 3