CISA Practice Question: Information Systems Operations and Business Resilience
An organization uses a cloud service provider (CSP) for critical applications. The IS auditor is reviewing the contract for vendor concentration risk. Which TWO clauses are MOST relevant to mitigating this risk?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A clause requiring the CSP to disclose and obtain approval for any subcontractors.
Vendor concentration risk is the risk of over-reliance on a single vendor. An exit strategy clause ensures the ability to transition away, and a subcontracting controls clause (fourth-party risk) addresses the CSP's use of other vendors that could increase concentration. SLA monitoring is important but not directly for concentration; right-to-audit is a general control; data encryption is about security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A clause requiring the CSP to disclose and obtain approval for any subcontractors.
Why this is correct
Helps manage fourth-party risk that could increase concentration.
- ✗
A service level agreement (SLA) with financial penalties for non-performance.
Why it's wrong here
Important for performance, but does not address concentration risk.
- ✗
A data encryption clause requiring encryption at rest and in transit.
Why it's wrong here
Security control, not for concentration risk.
- ✓
An exit strategy clause that defines transition assistance and data extraction procedures.
Why this is correct
Ensures the organization can switch vendors if needed, reducing concentration risk.
- ✗
A right-to-audit clause allowing the organization to audit the CSP.
Why it's wrong here
General control, not specifically for concentration risk.
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.