mediumMultiple Select
CCSP Practice Question: Which THREE of the following are commonly…
Which THREE of the following are commonly required when conducting a cloud vendor risk assessment?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Security certifications (e.g., ISO 27001)
Financial stability, certifications, and incident response plans are standard vendor risk assessment items. Pricing comparison is procurement, not risk; marketing materials are irrelevant.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Security certifications (e.g., ISO 27001)
Why this is correct
Security certifications such as ISO 27001 provide independently audited evidence of a vendor's control environment, satisfying the due-diligence requirement to verify security posture without onsite inspection. They let assessors map vendor controls to their own framework, confirming Microsoft Entra ID, encryption and access controls meet recognised baselines before data is entrusted to the provider.
- ✓
Financial stability of the vendor
Why this is correct
Financial stability directly addresses vendor viability risk, a core component of cloud vendor risk assessment. Assessing a provider's solvency, funding and revenue resilience satisfies the requirement to evaluate whether the vendor can sustain service delivery and contractual commitments over the engagement term, mitigating abrupt termination or insolvency exposure.
- ✓
Vendor's incident response plan
Why this is correct
A vendor's incident response plan reveals how breaches are detected, escalated and remediated, letting the assessor judge whether contractual notification timelines and containment obligations can actually be met, which is a standard cloud vendor risk assessment artefact.
- ✗
Pricing compared to competitors
Why it's wrong here
Competitor pricing is commercial benchmarking, not a risk control, so it evidences no security posture. It tempts because cost analysis accompanies procurement, yet a vendor risk assessment requires control evidence such as certifications, audit reports and data-handling terms.
- ✗
Marketing materials and brand reputation
Why it's wrong here
Marketing materials and brand reputation are promotional artefacts, not assurance evidence, so they cannot substantiate control effectiveness. They tempt because reputation feels risk-relevant, but a vendor risk assessment requires independent attestations, audit reports and contractual security commitments.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.