Analyze Security of Third-Party Software CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst is reviewing a third-party vendor's cloud controls matrix (CCM) and notices that the 'Incident Response' control states 'The vendor will notify customers of a security incident within 72 hours of discovery.' The vendor's SOC 2 Type II report includes a control description for incident response but does not specify a notification timeframe. The analyst's organization requires notification within 24 hours. What should the analyst do?

   • ARequest a contractual amendment to require notification within 24 hours, since the CCM's 72-hour commitment does not meet the organization's requirement.
   • BAccept the vendor's 72-hour notification because the CCM is the vendor's official commitment.
   • CReject the vendor because the SOC 2 Type II report does not specify a notification timeframe, indicating the vendor has no incident response process.
   • DRely on the SOC 2 Type II report because it is an independent attestation and overrides the CCM's 72-hour commitment.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   A third-party software vendor claims to have achieved SOC 2 Type II certification. Which statement best describes what this certification attests to?

   • AThe vendor has implemented a full information security management system that is certified by an accredited body.
   • BThe vendor's controls were audited for suitability over a period of time, and the auditor tested their operational effectiveness.
   • CThe vendor's security policies were reviewed and approved by an independent auditor at a single point in time.
   • DThe vendor's cloud service has been authorized to process federal government data based on a FedRAMP assessment.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is evaluating a third-party identity provider (IdP) that will be integrated into its customer-facing application. The vendor's cloud controls matrix (CCM) indicates that multi-factor authentication (MFA) is 'available' for customer accounts. The vendor's SOC 2 Type II report includes a control description stating that MFA is 'offered as an optional feature' but does not describe any testing of MFA enforcement. The company's security policy requires MFA to be enforced for all customer accounts. What should the company do?

   • AReject the vendor because the SOC 2 Type II report's failure to test MFA enforcement means the vendor is non-compliant with its own CCM.
   • BProceed with the vendor because the CCM confirms MFA availability, which satisfies the policy requirement.
   • CAsk the vendor to configure MFA as mandatory in the IdP and request evidence (e.g., configuration screenshots or a penetration test) that enforcement is active.
   • DRequire the vendor to provide a written statement that MFA is enforced by default for all new customer accounts.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A government contractor is evaluating a cloud-based document management system that will handle controlled unclassified information (CUI). The vendor holds FedRAMP Moderate authorization. The contractor's security team also sees that the vendor has ISO 27001 certification and a SOC 2 Type II report. Which certification or authorization is most directly relevant to the contractor's requirement to handle CUI?

   • AAll three are equally relevant because they all attest to the vendor's overall security posture.
   • BFedRAMP Moderate, because it is the federal authorization specifically designed for cloud services handling CUI at the moderate impact level.
   • CSOC 2 Type II, because it provides independent assurance of control effectiveness over a period of time.
   • DISO 27001, because it is the international standard for information security management systems.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which third-party security certification or attestation is specifically designed for cloud service providers to demonstrate compliance with U.S. federal government security requirements?

   • APCI DSS
   • BISO/IEC 27001
   • CSOC 2
   • DFedRAMP
   Reveal Solution Discussion Select an answer first