Analyze Security of Third-Party Software CSSLP Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A multinational corporation is evaluating a cloud-based HR platform that will store employee data for operations in the EU and the US. The vendor holds ISO 27001 and SOC 2 Type II, and provides a cloud controls matrix (CCM) showing data residency options in both regions. The EU legal team requires that personal data of EU employees remain within the EU. The US team wants the lowest-latency access for US-based administrators. What is the most appropriate course of action?

   • ARequest a custom data residency addendum from the vendor to allow EU data to be stored in the US under contractual controls.
   • BStore all data in the EU region to simplify compliance, and accept higher latency for US administrators.
   • CConfigure the platform to store EU employee data in the EU region and US employee data in the US region, using the vendor's documented residency controls.
   • DStore all data in the US region because SOC 2 Type II certification guarantees compliance with EU data residency laws.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of a cloud controls matrix (CCM) when evaluating a third-party cloud service provider?

   • ATo map the provider's security controls to industry-accepted frameworks and standards, facilitating assessment of control coverage.
   • BTo serve as a legally binding contract that guarantees the provider will not suffer a data breach.
   • CTo list the provider's pricing tiers and service-level agreements for each cloud service offered.
   • DTo provide a real-time dashboard of the provider's network traffic and intrusion detection alerts.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A financial services firm is selecting a third-party payment processing library. Vendor A holds SOC 2 Type II and has a strong public track record, but its last release was 18 months ago and its support forum shows unanswered security questions. Vendor B has no formal certification but releases patches monthly and responds to security advisories within 24 hours. The firm's policy requires documented security assurance for all critical third-party components. What should the firm do?

   • ASelect Vendor A because SOC 2 Type II is the definitive indicator of ongoing security maintenance.
   • BSelect Vendor B because rapid patching is more important than any certification.
   • CReject both vendors and restart the search because neither fully satisfies the firm's documented assurance requirement.
   • DPerform a focused security assessment of Vendor B's patching and response processes, and document the findings to satisfy the assurance policy.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst is reviewing a third-party SaaS vendor's cloud controls matrix (CCM) to verify that the vendor encrypts data at rest. The CCM lists 'AES-256 encryption for data at rest' under the 'Data Encryption' control. However, the vendor's SOC 2 Type II report does not mention encryption at rest in its control descriptions or testing procedures. What is the most appropriate conclusion?

   • AThe SOC 2 Type II report's silence on encryption at rest means the control is not in scope, so the CCM claim cannot be independently verified.
   • BThe analyst should immediately reject the vendor because a discrepancy between the CCM and SOC 2 report indicates a security incident.
   • CThe vendor is non-compliant with its own CCM because the SOC 2 report should have tested every control listed in the CCM.
   • DThe CCM is the authoritative source, and the SOC 2 report omission is irrelevant because the CCM is more current.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A healthcare SaaS provider is being evaluated for a system that will process protected health information (PHI) for a US-based hospital. The vendor holds both SOC 2 Type II and ISO 27001 certifications, but the hospital's compliance team insists on a FedRAMP authorization. The vendor explains they have not pursued FedRAMP because they do not serve government agencies. Which statement best describes the compliance team's requirement?

   • AThe hospital should require FedRAMP because it is the only certification that legally permits processing of PHI in the United States.
   • BThe hospital's requirement is likely driven by internal policy or future federal business needs, not a strict legal mandate for all PHI processing.
   • CThe hospital must reject the vendor because ISO 27001 is not recognized by US regulators for any data processing activity.
   • DThe hospital can accept SOC 2 Type II as sufficient because it covers PHI-specific controls more thoroughly than FedRAMP.
   Reveal Solution Discussion Select an answer first