Exam CAS-005 topic 1 question 51 discussion

✅ A. At the individual product level 🔍 Explanation: When a critical vendor supplies multiple products, a proper risk assessment should be conducted for each product individually. This is because: Each product may have different security risks, data sensitivities, compliance requirements, or integration points with your systems. Assessing risk at the vendor level alone may miss product-specific vulnerabilities or operational dependencies. ❌ Why the other options are incorrect: B. Through the selection of a random product This introduces bias and does not ensure full visibility into the vendor's risk posture. C. Using a third-party audit report Helpful as supplemental evidence, but not a replacement for a tailored risk assessment. D. By choosing a major product May miss risks in less critical but still impactful products.