SY0-701 Question 153
Single answerThird-party vendorsA healthcare company is onboarding a third-party billing vendor that will remotely access systems containing protected health information (PHI). The security administrator must reduce the risk introduced by the vendor while ensuring the company can verify the vendor is meeting contractual security requirements over time. Which of the following is the BEST action to take?
- A
Require the vendor to sign an NDA and accept the company's acceptable use policy before access is granted
- B
Allow vendor access only through a dedicated account that uses least privilege, MFA, and is reviewed through periodic third-party risk assessments
- C
Place the vendor on the same internal network segment as the billing servers to simplify troubleshooting and improve performance
- D
Rely on the vendor's statement that it is HIPAA compliant and postpone formal security reviews until after deployment
Show answer and explanation
Correct answer: B
Explanation
Third-party vendors introduce supply chain and access management risk, especially when they handle sensitive data such as PHI. The best approach is to combine strong access controls with ongoing vendor oversight. In practice, this means assigning unique accounts, enforcing least privilege, requiring MFA for remote access, and conducting periodic vendor risk reviews or assessments to confirm the vendor still meets security and contractual obligations. This aligns with common Security+ objectives around third-party risk management, account management, and secure access controls. It also reflects widely accepted guidance such as NIST SP 800-171 and NIST SP 800-53 control families related to access control, vendor assessments, and continuous monitoring, as well as HIPAA's emphasis on safeguarding protected health information through administrative, technical, and physical controls.
- A. Incorrect.
This is partially helpful but not the best answer. An NDA and acceptable use policy can support legal and administrative control objectives, but they do not sufficiently reduce technical risk by themselves. For a third-party vendor with remote access to PHI, stronger controls are needed, such as least privilege, MFA, and ongoing assurance activities. A candidate might choose this because contracts and policies are important in vendor relationships, but they are not enough alone.
- B. Correct.
This is correct. A dedicated vendor account limits accountability issues associated with shared credentials. Least privilege reduces access to only what the vendor needs. MFA reduces the likelihood of compromise of remote access. Periodic third-party risk assessments help verify the vendor continues to meet contractual and security requirements over time. This combines technical, administrative, and governance controls, which is the most appropriate response for managing third-party vendor risk in a regulated environment.
- C. Incorrect.
This is incorrect. Placing a vendor on the same internal network segment increases risk by expanding the blast radius if the vendor account or connection is compromised. Best practice is to limit and segment vendor access rather than broaden it. Someone might choose this option because it sounds operationally convenient, but convenience should not override security controls for third-party access.
- D. Incorrect.
This is incorrect. Self-attestation from the vendor is not sufficient assurance for high-risk access to systems containing PHI. Formal due diligence and ongoing review should occur before and during the relationship, not be delayed until after deployment. A candidate might select this if they confuse vendor claims of compliance with independent verification, but risk management requires validation.