8.4 - Assess Security Impact of Acquired Software CISSP Practice Questions (Page 3)

Questions 11–15

1. 11application · easy

   A company is considering using a cloud-based platform to develop and deploy a custom application. The platform provides the runtime environment and manages the underlying infrastructure, but the company is responsible for the application code and data. Which cloud service model is this?

   • AInfrastructure as a Service (IaaS)
   • BSoftware as a Service (SaaS)
   • CPlatform as a Service (PaaS)
   • DFunction as a Service (FaaS)
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a supply chain attack in the context of third-party software?

   • AAn attack that uses social engineering to trick employees into installing malicious software
   • BAn attack that targets the organization's physical supply chain, such as tampering with hardware during shipping
   • CAn attack that exploits a vulnerability in the organization's network perimeter to gain unauthorized access
   • DAn attack that compromises a software vendor's development or distribution process to inject malicious code into the software
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An organization is outsourcing its email system to a managed service provider. The MSP will host the email servers and manage the infrastructure. The organization's security team requires that all email data be encrypted at rest and in transit. Which of the following is the MOST important item to include in the SLA?

   • AThe MSP's encryption standards and key management practices
   • BThe MSP's backup and recovery procedures
   • CThe MSP's employee training program
   • DThe MSP's help desk response time
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is a security risk that is more prominent in Software as a Service (SaaS) than in IaaS?

   • AThe organization is responsible for patching the operating system of the underlying servers
   • BThe organization must configure network firewalls to protect the virtual network
   • CThe organization must manage the runtime environment for its applications
   • DThe organization has limited visibility into the provider's security controls and data handling practices
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An organization is outsourcing its help desk and IT support to a managed service provider (MSP). The MSP will have remote access to the organization's internal systems. Which of the following is the MOST critical requirement to include in the service-level agreement (SLA)?

   • AThe MSP's data backup procedures
   • BThe MSP's access control and authentication requirements
   • CThe MSP's office location and physical security
   • DThe MSP's employee training program
   Reveal Solution Discussion Select an answer first