GRC Third-Party Risk Management 3

Question 1

Which framework specifically provides a standardized questionnaire used widely in vendor security assessments?

Accepted Answer

Shared Assessments SIG (Standardized Information Gathering)

Answer

The Shared Assessments SIG is a comprehensive, industry-standard questionnaire used to assess vendor security, privacy, and compliance controls.

Question 2

When a vendor relationship ends, which action is MOST critical from a data security standpoint?

Accepted Answer

Ensuring the vendor destroys or returns all organizational data per contract terms

Answer

Data destruction or return during offboarding prevents residual data exposure and is a core requirement in most data processing agreements.

Question 3

A company relies on a single cloud provider for 85% of its IT infrastructure. This situation BEST exemplifies:

Accepted Answer

Vendor concentration risk

Answer

Vendor concentration risk occurs when over-reliance on a single vendor creates a single point of failure that could broadly disrupt operations.

Question 4

A SOC 2 Type II report differs from a SOC 2 Type I report in that it:

Accepted Answer

Tests controls over a period of time rather than at a single point in time

Answer

SOC 2 Type II evaluates the operational effectiveness of controls over a defined period (usually 6–12 months), whereas Type I only assesses design at a point in time.

Question 5

Which approach to third-party risk assessment relies on real-time or near-real-time data feeds about a vendor's security posture from external sources?

Accepted Answer

Continuous monitoring / cyber risk ratings

Answer

Cyber risk rating platforms (e.g., BitSight, SecurityScorecard) continuously scan external-facing vendor infrastructure to provide ongoing security posture signals.

(GRC) Governance, Risk, and Compliance Certification Practice Test

(GRC) Governance, Risk, and Compliance Certification Practice Test

GRC Third-Party Risk Management 3