Ensure and Verify Supplier Security Requirements in the Acquisition Process CSSLP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which source of information is most reliable for assessing a supplier's historical security track record?

   • AThe supplier's own marketing materials describing their security posture
   • BAnonymous online forum posts about the supplier
   • CPublicly reported security incidents and vulnerabilities involving the supplier's products
   • DThe supplier's number of employees
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A supplier has agreed to allow your organization to audit their secure software development practices. However, the supplier's development team uses an agile methodology with frequent releases, and your audit is scheduled for a single point in time. What is the best way to ensure the audit reflects the supplier's actual practices?

   • AReview the supplier's security policies and compare them to industry standards
   • BUse a combination of interviews, artifact review, and observation of a development iteration
   • CPerform the audit during a release cycle to observe the process in action
   • DRely on the supplier's self-assessment questionnaire
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   Your organization is choosing between two suppliers for a security-critical component. Supplier A offers a commercial license with a support contract that includes a 24-hour response time for critical vulnerabilities. Supplier B offers the same component under an open-source license with community support only. Your team has the expertise to handle security issues internally, but your compliance department requires a defined support structure for critical components. What is the most appropriate decision?

   • AChoose Supplier A because the support contract meets compliance requirements
   • BChoose Supplier A but negotiate a reduced support level to lower costs
   • CChoose Supplier B and document that your team will provide internal support
   • DChoose Supplier B because your team has the expertise to handle issues
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   Your organization is procuring a platform-as-a-service (PaaS) offering. The vendor is responsible for securing the underlying platform, but your team is responsible for the application code and its configuration. During a security review, you need to ensure that the vendor's security testing covers the platform layer. What is the best way to verify this?

   • ARequire the vendor to share their source code for your review
   • BRely on the vendor's marketing claims about security
   • CReview the vendor's SOC 2 report and penetration testing results for the platform
   • DConduct your own penetration test on the vendor's platform
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In a supplier engagement, what does the shared responsibility model primarily define?

   • AThe number of security patches required per year
   • BThe legal jurisdiction for disputes
   • CWhich party is responsible for which security testing and control activities
   • DThe total cost of the engagement
   Reveal Solution Discussion Select an answer first