8.4 - Assess Security Impact of Acquired Software CISSP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   When acquiring commercial off-the-shelf (COTS) software, which of the following is a key security consideration that should be evaluated during the procurement process?

   • AThe cost of the software compared to similar products on the market
   • BThe software's user interface design and ease of use for employees
   • CThe number of features included in the software to ensure it meets all functional requirements
   • DThe vendor's patch management process and historical responsiveness to vulnerabilities
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company is evaluating a commercial software product that is critical to its operations. The vendor has a strong security reputation and provides a comprehensive security whitepaper. However, the product has a known vulnerability that the vendor has not yet patched. The company's security team has determined that the vulnerability is not exploitable in the company's environment due to compensating controls. Which of the following is the BEST course of action?

   • AProceed with the acquisition and rely on the compensating controls
   • BAcquire the product but require the vendor to sign a contract committing to a patch timeline
   • CAcquire the product and immediately implement additional compensating controls
   • DReject the product and select a different vendor
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company is deciding between using a SaaS application and building a custom application on IaaS. The company's security team is concerned about the security of customer data. Which of the following is the MOST important factor to consider when making this decision?

   • AThe cost of the solution
   • BThe time to implement the solution
   • CThe level of control the company has over the security of the application and data
   • DThe vendor's reputation
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is acquiring a commercial customer relationship management (CRM) system delivered as SaaS. The vendor's security documentation states that they undergo annual SOC 2 audits and provide a detailed shared responsibility matrix. The company's compliance team requires that customer data be stored only in the United States. Which of the following is the MOST important additional factor to verify before signing the contract?

   • AThe vendor's use of open source components in their application
   • BThe vendor's data residency options and the location of their data centers
   • CThe vendor's employee background check policy
   • DThe vendor's patch management process for the underlying operating system
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   During vendor due diligence for third-party software, which of the following is a key security factor to evaluate?

   • AThe vendor's marketing materials and product brochures
   • BThe vendor's security testing practices and vulnerability disclosure program
   • CThe vendor's customer support hours and response times
   • DThe vendor's office location and number of employees
   Reveal Solution Discussion Select an answer first