Third Party and Vendor Risk Management Quiz

1. Which document typically outlines the security expectations and responsibilities between an organization and vendor?

Service Level Agreement (SLA) or Data Processing Agreement (DPA)

Employee handbook

Marketing brochure

Annual financial report

2. Which monitoring practice helps detect unauthorized or anomalous vendor activity?

Logging and analyzing vendor system access, data transfers, and authentication events

Trusting vendors without oversight

Disabling all audit logs

Granting vendors complete anonymity

3. What should be included in a vendor security questionnaire?

Questions about access controls, incident response, data protection, and compliance certifications

Only vendor pricing information

Personal employee information

Vendor's favorite colors

4. Which of the following represents a proactive approach to vendor risk management?

Conducting regular risk assessments, maintaining security requirements, and updating vendor agreements

Waiting for vendor breaches before taking action

Assuming all vendors are equally trustworthy

Avoiding vendor communication altogether

5. A Data Processing Agreement (DPA) is primarily used to address which concern?

Data protection and privacy compliance when vendors process personal or sensitive organizational data

Vendor marketing strategies

Employee social events

Vendor office layout design

6. What is the purpose of a vendor exit strategy?

To ensure secure data transition, system deprovisioning, and minimal operational disruption when ending vendor relationships

To surprise vendors with sudden termination

To avoid paying final vendor invoices

To delete all vendor data without backup

7. Which of the following is a best practice for managing multiple vendors in a supply chain?

Maintain a vendor inventory, conduct regular assessments, and establish clear escalation procedures

Use as many vendors as possible without tracking them

Avoid documenting vendor relationships

Never communicate security requirements to vendors

8. What is the significance of a vendor's security certifications (e.g., ISO 27001, SOC 2)?

They demonstrate the vendor's commitment to security standards and compliance with industry best practices

They guarantee the vendor will never have a security incident

They are only for marketing purposes

They eliminate the need for security assessments

9. The practice of requiring vendors to carry cyber liability insurance is part of which risk management strategy?

Risk mitigation through financial protection and vendor accountability

Risk acceptance without controls

Risk avoidance by not using vendors

Risk ignorance and denial

10. What should an organization do if a vendor experiences a security breach?

Request timely notification, conduct impact assessment, and verify vendor's remediation plan

Ignore the breach and continue operations

Immediately terminate the vendor without investigation

Post the breach on social media immediately

11. Which of the following is the primary purpose of conducting vendor risk assessments?

To identify potential security vulnerabilities and compliance gaps in third-party systems

To determine vendor pricing and contract terms

To establish long-term vendor relationships only

To eliminate all vendors from the supply chain

12. What is a critical aspect of managing vendor access to organizational systems?

Implementing least privilege access, monitoring vendor activities, and regular access reviews

Granting permanent full administrative access

Allowing vendor self-service privilege escalation

Disabling all vendor account logging

13. Which of the following should be addressed in a vendor security audit?

Access controls, encryption practices, incident response procedures, and compliance certifications

Vendor employee vacation schedules

Vendor office furniture inventory

Vendor employee personal hobbies

14. What is the purpose of vendor performance monitoring?

To ensure vendors meet security, compliance, and service requirements on an ongoing basis

To embarrass underperforming vendors

To collect vendor marketing data

To reduce vendor compensation

15. Which framework is commonly used for assessing third-party risk?

NIST Cybersecurity Framework and ISO/IEC 27001

Social media analytics

Vendor marketing materials

Customer satisfaction surveys

16. What should be included in the vendor onboarding process?

Security assessments, compliance verification, and access provisioning reviews

Immediate full system access without evaluation

Social media background checks only

Vendor pricing negotiations exclusively

17. Which of the following is an example of a supply chain attack?

A threat actor compromising vendor software to distribute malware to multiple organizations

A vendor increasing product prices

A vendor changing their business location

A vendor hiring new employees

18. What is supply chain risk?

The potential for compromise or disruption through any part of the vendor ecosystem or products

The cost of shipping products to customers

The time it takes vendors to deliver services

The number of vendors an organization uses

19. Which practice helps mitigate risks associated with vendor lock-in?

Implementing exit strategies and data portability requirements in contracts

Using only a single vendor for critical services

Avoiding written agreements with vendors

Increasing vendor system access privileges

20. What is a key element that should be included in vendor contracts to protect organizational security?

Service level agreements (SLAs) with security requirements and breach notification clauses

Unlimited vendor access to all organizational systems

Vendor autonomy without security oversight

Quarterly vendor social events

Security+ Third Party and Vendor Risk Management Quiz