Free Certified Implementation Specialist – Vendor Risk Management Exam CIS-VRM Exam Practice Test

All Assessment Metrics within a Metric Category are scored, are rolled up, and get a score of.

• 0-5
• 0-100
• 0-20
• 0-10

Key data sources for Vendor Risk reporting include which of the following tables? (Choose two.)

• Vendor Risk Assessment [sn_vdr_risk_asmt_assessment]
• Questionnaire Templates [asmt_metric_type]
• Vendor Benchmark Scores [sn_vdr_client_score]
• Survey Scores [snc_survey_scores]
• Vendor Risk Issue [sn_vdr_risk_asmt_issue]

What is the minimum role required to create a new Vendor Risk Issue?

• Vendor Risk Assessor [sn_vdr_risk_asmt.vendor_assessor]
• Vendor Assessment Reviewer [sn_vdr_risk_asmt.vendor_assessment_reviewer]
• Vendor Risk Manager [sn_vdr_risk_asmt.vendor_risk_manager]
• System Administrator [admin]

A vendor is assessed and responds to a question which impacts one of the Controls applied to them. When is the Control Status updated?

• When the Vendor Risk Assessment State is Responses Received
• When the Vendor Risk Assessment State is Finalizing with Vendor or Closed
• When the Vendor Risk Assessment response is saved
• When all Questions in the Vendor Risk Assessment have a response

A Vendor Risk Manager needs to run a report displaying Critical Vendors. On which table would this person run a report?

• Company [core_company]
• Vendor Risk Issue [sn_var_asmt_issue]
• Vendor Contact (vm_vdr_contact]
• Vendor Risk Assessment [sn_vdr_risk_asmt_assessment]

In the Paris release and beyond, the scoped vendor portal (svdp) will be installed by default but can be overridden in which System Property record to use the legacy/traditional vendor portal (vdp)?

• sn_vdr_risk_asmt.vendor_portal
• sn_vdr_risk_asmt.scoped.vendor_portal_endpoint
• sn_vdr_risk_asmt.vendor_portal_endpoint
• sn_vdr_risk_asmt.scoped.vendor_portal

Which of the following is an objective of Vendor Risk Management? (Choose two.)

• To help vendors improve their security posture and preparedness
• To assess and manage the risk from interactions with vendors and third parties
• To help negotiate the best possible price for a product or service from the vendor
• To verify that vendors have adequate measures and processes in place to ensure profitability of vendor

What is the no code option to cleaning data being loaded into the Vendor Risk application?

• Fix Scripts
• Field Normalization
• Import

Which statement best describes the SIG Lite?

• The SIG Lite is a company specific questionnaire
• The SIG Lite is a ServiceNow developed questionnaire
• The SIG Lite assesses basic levels of due diligence and provides a broad but high-level understanding about internal security controls
• The SIG Lite assesses service providers that store or manage highly sensitive or regulated information

For each questionnaire template/assessment metric type, how many vendor risk areas can be designated?

• One
• As many as desired
• None
• Two