CRISC Third-Party and Vendor Risk Management 2

Question 1

Concentration risk in third-party management occurs when:

Accepted Answer

A single vendor provides services to multiple business units or critical functions

Answer

A vendor concentrates solely on one industry vertical

Answer

Multiple vendors compete for the same contract

Answer

An organization diversifies across too many vendors

Question 2

Under the shared responsibility model for cloud services, who is responsible for classifying and protecting customer data stored in the cloud?

Accepted Answer

The customer organization

Answer

The cloud service provider exclusively

Answer

A jointly appointed data governance committee

Answer

The regulatory authority overseeing the organization

Question 3

What is the BEST approach for managing vendor risk when a vendor refuses to allow direct audits?

Accepted Answer

Require the vendor to provide third-party audit reports such as SOC 2 Type II

Answer

Terminate the vendor immediately regardless of the business relationship

Answer

Accept the vendor's word that their controls are adequate

Answer

Reduce the contract value to reflect the increased risk

Question 4

A vendor risk register should PRIMARILY contain:

Accepted Answer

Identified risks associated with each vendor, their likelihood, impact, and mitigating controls

Answer

A list of vendors ranked by contract value

Answer

A record of all vendor invoices and payment history

Answer

Marketing contact information for each vendor

Question 5

Which regulatory framework explicitly requires organizations to assess and manage third-party risks for financial institutions?

Accepted Answer

FFIEC IT Examination Handbook (Third-Party Relationships)

Answer

COBIT 2019

Answer

ISO 9001

Answer

PMBOK Guide

Question 6

During a vendor security incident that affects your organization's data, what is the FIRST step the organization should take?

Accepted Answer

Activate the incident response plan and notify relevant internal stakeholders

Answer

Immediately terminate the vendor contract

Answer

Issue a public press release about the incident

Answer

Wait for the vendor to fully resolve the incident before taking action

Question 7

What is the purpose of a Data Processing Agreement (DPA) in vendor contracts?

Accepted Answer

To define terms under which a vendor may process personal data on behalf of the organization

Answer

To specify the technical architecture the vendor must use

Answer

To allocate hardware procurement responsibilities between parties

Answer

To establish vendor employee training schedules