Free Third-Party Risk and Compliance practice questions
10 free SY0-801 questions on Third-Party Risk and Compliance, each with a full explanation — no account needed. This section sits in the Program Management and Oversight part of the exam. Answer every question to see your score, then read the lessons below for anything you missed.
A company has already chosen a SIEM product and now needs price, delivery and support terms for 250 more seats of exactly that product. Which document should it send to vendors?
When the requirement is fully specified and only price, delivery and terms remain to compare, the buyer sends an RFQ. An RFP invites vendors to propose how they would meet requirements, an RFI explores what the market offers, and an EOI finds out which suppliers are interested and qualified.
A state agency is planning a large security operations center project and expects dozens of bidders. Before issuing a formal request for proposals, it wants to learn which suppliers want to take part and are qualified, so it can build a shortlist. Which document fits?
An EOI asks which suppliers are interested in a planned project and qualified for it, and the replies form the shortlist for the formal request. An RFI is the tempting choice, but it asks what products and capabilities exist rather than who wants in, and an RFQ only compares prices for a defined requirement.
In an RFP evaluation, the vendor with the best total score can't meet a security requirement the RFP marked Mandatory. What should happen?
Mandatory requirements act as a gate, so a vendor that can't meet one is eliminated before price is considered. Losing only some points is tempting, but that is how desired requirements work in scoring, not mandatory ones, and downgrading a requirement for one bidder would undo the gate.
A SaaS vendor's SOC 2 Type II report carves out its hosting provider as a subservice organization. What should the customer's reviewer do to cover the hosting layer?
A carved-out subservice organization isn't covered by the vendor's report, so the reviewer needs the hosting provider's own report too. A Type II report only covers what is in its scope, a SOC 3 is a shorter summary of the same SOC 2, and a bridge letter is an untested management statement that covers a time gap, not a scope gap.
A small, recently funded startup will supply software the business can't operate without. Which safeguard protects the customer if the startup goes out of business?
Source code escrow releases the code to the customer if the vendor goes under, which keeps critical software usable after a failure. A SOC 2 report and a right to audit give evidence about controls but nothing usable once the vendor has failed, and an NDA only protects information the parties share.
Before due diligence begins, a prospective vendor will share its SOC 2 report and penetration test summary, and the buyer will share network diagrams. What should both parties sign first?
An NDA obliges each receiving party to keep defined information confidential and use it only for the stated purpose, and a mutual NDA fits when both sides share. It is usually the first document signed with a prospective vendor. An SLA sets service levels, a SOW defines one engagement, and an MOA assigns duties between cooperating parties.
A provider's SLA promises 99.9 percent availability over a 30-day month. About how much downtime does that allow before service credits apply?
A 30-day month has 43,200 minutes, and 0.1 percent of that is 43.2 minutes. About 4 minutes is the allowance for 99.99 percent and about 7 hours would be 99 percent, so miscounting the nines is the usual slip.
Two state agencies are connecting their systems for a joint incident reporting service. They want a document that spells out which agency supplies staff, which systems connect and how costs are shared. Which agreement fits BEST?
An MOA sets out each party's specific responsibilities and conditions, such as staffing, connections and cost sharing, and is more formal than an MOU. An MOU is the tempting choice, but it records shared intent and cooperation rather than defining each party's duties, and it is generally not binding.
A SaaS outage costs a retailer far more in lost sales than the 10 percent service credit its SLA provides. The business says it can't tolerate another outage that long. What is the BEST response?
Service credits compensate a little after a failure but don't make the service resilient, so a business that can't tolerate the outage needs redundancy and continuity planning. A larger credit schedule is tempting, but it still pays out only after the damage, and an SLO or MOU carries even less consequence than the SLA.
A hospital plans to let a cloud transcription service handle protected health information on its behalf. Which agreement does HIPAA require before that happens?
HIPAA requires a business associate agreement before a vendor handles protected health information for a covered entity. An MOU records intent without binding duties, and while an MSA and an SLA may also be signed, neither is the agreement HIPAA specifically requires.
Study this section
Every lesson that covers Third-Party Risk and Compliance on the SY0-801 exam.