CRISC Risk Response and Reporting Practice Question
An organization is designing a vendor risk assessment process for critical vendors. Which THREE of the following should be included in the initial onboarding assessment?
⚠ Common exam trap
Watch out — candidates often confuse ongoing monitoring activities (like continuous monitoring or annual reassessments) with the discrete, upfront steps required during the initial vendor onboarding assessment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Security questionnaires
Security questionnaires are a foundational tool in initial vendor onboarding because they systematically gather detailed information about the vendor's security controls, policies, and practices. This allows the organization to assess the vendor's baseline security posture against its own requirements before any business relationship begins.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Security questionnaires
Why this is correct
Questionnaires gather vendor security posture information.
- ✗
Continuous monitoring via shared intelligence platforms
Why it's wrong here
Continuous monitoring is for ongoing, not initial assessment.
- ✓
Contract compliance review
Why this is correct
Reviewing contractual security requirements is essential.
- ✗
Annual reassessment
Why it's wrong here
Annual reassessment is part of ongoing monitoring.
- ✓
SOC 2 report review
Why this is correct
SOC 2 reports provide independent assurance over controls.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.