CCISO Vendor Management 4

Question 1

A CISO is selecting between two vendors: one holds ISO 27001 certification and the other provides a SOC 2 Type II report. Which statement BEST describes the difference?

Accepted Answer

ISO 27001 certifies an ISMS against a standard; SOC 2 Type II reports on operational effectiveness of controls over a period

Answer

ISO 27001 is a management system certification, while SOC 2 Type II is an attestation report covering the operational effectiveness of controls over a defined review period.

Question 2

An organization relies on a single vendor for 80% of its critical IT infrastructure. Which risk concept does this BEST illustrate?

Accepted Answer

Vendor lock-in and single point of failure

Answer

Over-reliance on a single vendor creates vendor lock-in and a single point of failure, significantly elevating operational and continuity risk.

Question 3

When a vendor handles cardholder data on behalf of an organization, which compliance framework DIRECTLY governs the vendor's security requirements?

Accepted Answer

PCI DSS

Answer

PCI DSS applies to any entity that stores, processes, or transmits cardholder data, including third-party vendors handling such data on behalf of merchants.

Question 4

A CISO wants to ensure vendors promptly notify the organization of security incidents. The contractual term that BEST enforces this requirement is:

Accepted Answer

Incident notification clause with defined timeframes

Answer

An incident notification clause with specific timeframes (e.g., within 72 hours) contractually obligates vendors to promptly report security incidents.

Question 5

Which approach BEST allows a CISO to assess a vendor's real-world security posture without performing a direct on-site audit?

Accepted Answer

Requesting and reviewing a third-party penetration test report or SOC 2 Type II attestation

Answer

Third-party audit reports such as SOC 2 Type II or penetration test summaries provide independent, evidence-based insights into vendor security effectiveness.

(CCISO) EC-Council Certified CISO Practice Test

(CCISO) EC-Council Certified CISO Practice Test

CCISO Vendor Management 4