A security manager at a healthcare organization is reviewing the results of a third-party vendor risk assessment for a cloud-based email service that will store protected health information (PHI). The assessment reveals that the vendor encrypts data at rest using AES-256 but does not support customer-managed encryption keys. The vendor's data center is located in a country that is not subject to HIPAA jurisdiction. The vendor's previous penetration test report is over 18 months old. Which of the following is the most appropriate risk management action for the security manager to take?

Accept the risk because the vendor uses strong encryption.

While AES-256 encryption is strong, it does not address the full range of risks, such as the lack of customer-managed keys, the outdated penetration test, or legal/compliance exposure from storing PHI in a non-HIPAA jurisdiction. Accepting the risk based on encryption alone ignores these other critical factors.

Terminate the contract immediately and select a different vendor.

Terminating immediately without further investigation may be an overreaction. The risks identified are notable but do not necessarily indicate that the vendor is in violation of HIPAA or unable to provide adequate security. A more measured approach, such as requesting updated documentation, should be taken first.

Require the vendor to implement customer-managed keys and provide a new penetration test report within 30 days.

While customer-managed keys and current penetration testing are desirable, the vendor may not be able to support customer-managed keys in their product architecture, and requiring implementation within 30 days is likely unrealistic. This option attempts to treat the risk through a technical control that the vendor may not offer, making it less practical than requesting an existing SOC 2 report.

What does this SY0-701 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Request the vendor to obtain a current SOC 2 Type II report and review the findings before making a decision. — When a third-party vendor will handle PHI, HIPAA requires a business associate agreement (BAA) and evidence of adequate safeguards. Outdated penetration tests and geographic storage concerns are significant risk indicators that need further investigation before making a final decision. Requesting a current SOC 2 Type II report (which includes a detailed assessment of controls, governance, and security operations) allows the security manager to evaluate the vendor's current security posture against the organization's requirements. This due diligence aligns with a risk management strategy of treating (remediating) the risk through informed decision-making, rather than simply accepting, avoiding, or demanding changes that may not be feasible.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.