ISP Supply Chain Security & Vendor Management 2

Question 1

Which of the following is the BEST method for evaluating a new vendor's security posture before awarding a contract?

Accepted Answer

Conducting a third-party security audit or requiring completion of a standardized security questionnaire

Answer

Reviewing the vendor's marketing materials and website

Answer

Checking the vendor's social media presence

Answer

Relying solely on the vendor's self-reported compliance status

Question 2

Under NIST SP 800-161, what is the primary purpose of a Supplier Risk Assessment?

Accepted Answer

To identify, assess, and mitigate cybersecurity and supply chain risks posed by ICT suppliers

Answer

To negotiate lower prices with suppliers

Answer

To audit a supplier's financial stability only

Answer

To eliminate all foreign-sourced components

Question 3

A critical industrial facility learns that its SCADA software vendor will reach end-of-life (EOL) in six months with no patches thereafter. What is the MOST appropriate response?

Accepted Answer

Develop a migration plan to supported software while implementing compensating controls during transition

Answer

Continue operations with the EOL software and monitor for issues

Answer

Immediately shut down all SCADA systems

Answer

Request the vendor extend support indefinitely at no cost

Question 4

Which clause in a vendor contract BEST helps protect an organization if a supplier experiences a security incident?

Accepted Answer

Security breach notification requirement clause

Answer

Force majeure clause

Answer

Net-30 payment terms clause

Answer

Exclusivity clause

Question 5

What is 'supply chain transparency' and why is it important for industrial security professionals?

Accepted Answer

The ability to trace components and services back to their origin to verify authenticity and integrity

Answer

Publishing all procurement costs publicly to deter fraud

Answer

Allowing all employees to view vendor contracts

Answer

Sharing proprietary supplier lists with industry partners

Question 6

Which of the following BEST describes a 'trusted supplier program' in an industrial security context?

Accepted Answer

A formal vetting and approval process that authorizes suppliers to provide goods or services with reduced oversight

Answer

A marketing program where suppliers pay for a certification badge

Answer

A program requiring all suppliers to be located domestically

Answer

A financial incentive program for suppliers who meet delivery deadlines

Question 7

When conducting a supply chain risk assessment, which factor is MOST critical when evaluating a foreign-based supplier?

Accepted Answer

Whether the supplier's country of origin has laws that could compel disclosure of sensitive information or data

Answer

The supplier's geographic proximity to the nearest airport

Answer

The supplier's number of employees

Answer

The local currency exchange rate