Analyze Security of Third-Party Software CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company is evaluating a third-party email security gateway. The vendor holds a SOC 2 Type II report and an ISO 27001 certification. The company's compliance team is specifically concerned about the vendor's ability to protect data in transit. Which document should the compliance team review to find the most specific information about encryption controls?

   • AThe vendor's marketing brochure, because it highlights the security features of the product.
   • BThe ISO 27001 certificate, because it lists all the controls the vendor has implemented.
   • CThe vendor's website FAQ, because it provides quick answers to common security questions.
   • DThe SOC 2 Type II report, because it includes detailed control descriptions and testing results for encryption.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security architect is evaluating a third-party payment processing API. The vendor's cloud controls matrix (CCM) states that 'all data is encrypted in transit using TLS 1.2 or higher.' The vendor's SOC 2 Type II report includes a control description for encryption in transit and states that the auditor tested the control. However, the architect's organization requires TLS 1.3 for all internet-facing communications. The vendor's CCM does not mention TLS 1.3. What should the architect do?

   • AReject the vendor because the CCM does not mention TLS 1.3, indicating the vendor does not support it.
   • BAsk the vendor whether TLS 1.3 is supported and, if so, request evidence (e.g., configuration documentation or a test) that it can be enforced.
   • CRely on the SOC 2 Type II report because it confirms the encryption control is tested, which is sufficient for the organization's requirement.
   • DAccept the vendor's TLS 1.2 because it is a widely accepted standard and the SOC 2 report confirms it is tested.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security architect is comparing two third-party cloud storage vendors. Vendor X provides a cloud controls matrix (CCM) that maps each control to a specific SOC 2 Type II control, and the SOC 2 report includes a 'complementary user entity controls' (CUECs) section. Vendor Y provides a CCM with similar controls but its SOC 2 report does not include a CUECs section. The architect's organization has strict internal requirements for key management and access reviews. Which consideration is most important when evaluating these vendors?

   • AVendor Y should be rejected because a SOC 2 report without a CUECs section is invalid and cannot be relied upon.
   • BThe architect should review Vendor X's CUECs to identify which security responsibilities remain with the organization, and verify the organization can fulfill them.
   • CThe architect should select Vendor Y because the absence of CUECs means the vendor takes full responsibility for all security controls.
   • DVendor X is inherently more secure because its CCM maps directly to SOC 2 controls, while Vendor Y's lack of mapping indicates weaker security.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is evaluating a third-party customer relationship management (CRM) vendor. The vendor holds ISO 27001 certification and provides a cloud controls matrix (CCM) that maps controls to ISO 27001 Annex A. The company's security team wants to verify that the vendor's access control policies are actually implemented. Which document or activity would provide the most direct evidence?

   • AThe vendor's SOC 2 Type II report, which includes testing of access control effectiveness over a period of time.
   • BThe vendor's marketing materials, which describe their security features and commitments.
   • CThe cloud controls matrix, because it lists the vendor's access control policies.
   • DThe ISO 27001 certificate, because it confirms the vendor's compliance with the standard.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is evaluating a commercial software vendor for a critical business application. The vendor is a small startup with a promising product but has been in business for only 18 months. The vendor's cloud controls matrix (CCM) lists strong security controls, and the vendor has provided a SOC 2 Type I report. The company's procurement team is concerned about the vendor's long-term viability. What is the most important additional factor to assess?

   • AThe company should assess the vendor's financial stability, customer retention, and product roadmap to gauge the risk of the vendor going out of business.
   • BThe company should require the vendor to obtain a SOC 2 Type II report before any contract is signed.
   • CThe company should reject the vendor because 18 months of operation is too short for any third-party software to be considered secure.
   • DThe vendor's SOC 2 Type I report is sufficient to confirm long-term viability because it verifies the design of controls.
   Reveal Solution Discussion Select an answer first