Review questions

1. Which of the following would bind a third party to provide monetary credits to the organization in case of a service failure?
   1. Master service agreement
   2. Service-level agreement
   3. Non-disclosure agreement
   4. External audit
2. Which of the following should be signed with the third party to protect the intellectual property and interests of the organization?
   1. Master service agreement
   2. Service-level agreement
   3. Non-disclosure agreement
   4. External audit
3. Which of the following is not the final output of an external audit?
   1. SOC 2 report
   2. ISO 27001 certification
   3. HITRUST certification
   4. Non-disclosure agreement
4. The IT team is implementing new software across the organization and is defining the baseline control settings for end users. This is an example of ___.
   1. Release management
   2. Change management
   3. Configuration management
   4. Exception management
5. The risk practitioner should review and verify the granted exceptions are still required at least ___.
   1. Weekly
   2. Monthly
   3. Quarterly
   4. Annually
6. The CAB should...