GRC Third-Party Risk Management 4

Question 1

Which metric is MOST useful for measuring how quickly an organization identifies and responds to vendor-related security incidents?

Accepted Answer

Mean Time to Detect and Respond (MTTR/MTTD) for vendor incidents

Answer

MTTD and MTTR quantify detection and response speed, which are critical efficiency metrics for third-party incident management.

Question 2

Which of the following is an example of residual risk in a vendor relationship?

Accepted Answer

The risk remaining after all agreed-upon controls and mitigations have been implemented

Answer

Residual risk is what remains after controls and mitigations are applied; it must be accepted, further mitigated, or transferred (e.g., via insurance).

Question 3

A technology vendor notifies your organization of a ransomware attack affecting their systems that store your customer data. What should be your organization's FIRST response step?

Accepted Answer

Activate the vendor incident response playbook and notify your legal and security teams

Answer

Activating the incident response playbook ensures a structured, timely response involving the right stakeholders, including legal and security teams.

Question 4

An inherent risk assessment of a vendor would evaluate risk:

Accepted Answer

Before any mitigating controls or safeguards are applied

Answer

Inherent risk represents the raw risk level associated with a vendor or activity before any controls are in place.

Question 5

Which of the following BEST supports a risk-based approach to vendor due diligence?

Accepted Answer

Scaling the depth and frequency of assessments based on the vendor's risk tier and data access

Answer

A risk-based approach tailors due diligence intensity to each vendor's risk profile, ensuring efficient use of assessment resources.

(GRC) Governance, Risk, and Compliance Certification Practice Test

(GRC) Governance, Risk, and Compliance Certification Practice Test

GRC Third-Party Risk Management 4