Question 1

Which requirement is the MOST important for managing risk when the vendor contract terminates?

Options :

A : The responsibility to perform a financial review of outstanding invoices

B : The commitment to perform a final assessment based upon due diligence standards

C : The requirement to ensure secure data destruction and asset return

D : The obligation to define contract terms for transition services

Answer: C

Question 2

Which of the following BEST describes the distinction between a regulation and a standard?

Options :

A :

A regulation must be adhered to by all companies subject to its requirements, but companies “can voluntarily choose to follow standards.

B : There is no distinction, regulations and standards are the same and have equal impact

C : Standards are always a subset of a regulation

D :

A standard must be adhered to by companies based on the industry they are in, while regulations are voluntary.

Answer: A

Question 3

Which of the following factors is LEAST likely to trigger notification obligations in incident response?

Options :

A : Regulatory requirements

B : Data classification or sensitivity

C : Encryption of data

D : Contractual terms

Answer: C

Question 4

Which statement BEST reflects the factors that help you determine the frequency of cyclical assessments?

Options :

A :

Vendor assessments should be conducted during onboarding and then be replaced by continuous monitoring

B :

Vendor assessment frequency should be based on the level of risk and criticality of the vendor to your operations as determined by their vendor risk score

C : Vendor assessments should be scheduled based on the type of services/products provided

D : Vendor assessment frequency may need to be changed if the vendor has disclosed a data breach

Answer: B

Question 5

Which statement is FALSE regarding the primary factors in determining vendor risk classification?

Options :

A : The geographic area where the vendor is located may trigger specific regulatory obligations

B : The importance to the outsourcer-s recovery objectives may trigger a higher risk tier

C :

The type and volume of personal data processed may trigger a higher risk rating based on the criticality of the systems

D :

Network connectivity or remote access may trigger a higher vendor risk classification only for third parties that process personal information

Answer: D