8.4 - Assess Security Impact of Acquired Software CISSP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company is considering using a third-party vendor to process customer payment data. The vendor is a small startup that has not been in business for long. Which of the following is the MOST important due diligence step before engaging this vendor?

   • AAsk for a list of the vendor's other clients
   • BReview the vendor's financial statements
   • CCheck the vendor's social media presence
   • DVerify the vendor's compliance with PCI DSS
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   When outsourcing to a managed service provider (MSP), which of the following is a critical security element to include in the service-level agreement (SLA)?

   • AThe provider's office location and physical security of their headquarters
   • BSpecific security controls and incident response procedures that the provider must follow
   • CThe provider's marketing claims about their security capabilities
   • DThe provider's employee satisfaction survey results
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is considering purchasing a commercial software product from a small vendor that has recently been acquired by a larger corporation. The product is critical to the company's operations, and the vendor has not yet released a security patch for a known vulnerability. Which of the following is the MOST important consideration when assessing the security impact of this acquisition?

   • AThe vendor's marketing materials and product roadmap
   • BThe vendor's patch management process and responsiveness to security issues
   • CThe vendor's financial stability and long-term viability
   • DThe vendor's employee headcount and office locations
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An organization is outsourcing its customer support function to a managed service provider. The MSP will have access to customer data, including personal information. The organization's legal team requires that the MSP comply with GDPR. Which of the following is the MOST important requirement to include in the SLA?

   • AThe MSP's backup and recovery procedures
   • BThe MSP's employee training program
   • CThe MSP's help desk response time
   • DThe MSP's data processing agreement and data transfer mechanisms
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a license compliance risk when using open source components in a proprietary software product?

   • AThe component being developed by a small team with limited resources
   • BThe component being written in a language that is not widely used in the organization
   • CUsing a component with a copyleft license that requires the proprietary code to be released under the same license
   • DThe component having a large number of known vulnerabilities in its public vulnerability database
   Reveal Solution Discussion Select an answer first