Ensure and Verify Supplier Security Requirements in the Acquisition Process CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which factor is most important to specify in a contract regarding supplier log integration into the customer's SIEM?

   • AThe number of employees the supplier has in their security team
   • BThe frequency and method of log delivery to the customer
   • CThe color scheme of the supplier's log management dashboard
   • DThe supplier's marketing budget for security products
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   Your organization is evaluating a supplier that has a strong security track record but has recently been acquired by a company with a poor security reputation. The supplier's current security team has remained in place, and they have assured you that their practices are unchanged. Your organization requires a high level of assurance for this critical component. What is the most prudent course of action?

   • AAccept the supplier's assurance because their security team is unchanged
   • BConduct a new security assessment of the supplier, including their relationship with the parent company
   • CTerminate the relationship due to the parent company's reputation
   • DRequest a contractual clause that holds the supplier liable for any security incidents
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   Your organization is procuring a software-as-a-service (SaaS) product. The vendor is responsible for the security of the application and underlying infrastructure, but your organization is responsible for user access management and client-side security. During a security review, your team discovers that the vendor's penetration testing does not cover the application's API endpoints. What is the most appropriate action?

   • AAccept the vendor's testing scope because they are responsible for the application
   • BRequire the vendor to expand their penetration testing to include API endpoints
   • CConduct your own penetration testing of the vendor's API endpoints
   • DRequest a discount because the vendor's testing is incomplete
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   Your organization is integrating a new supplier's logs into your SIEM. The supplier provides logs in a proprietary format that your SIEM cannot parse. Your team has limited resources to build a custom parser. What is the most efficient approach?

   • AIgnore the logs and rely on other sources
   • BAsk the supplier to provide logs in a standard format such as CEF or JSON
   • CStore the logs in raw form without parsing
   • DBuild a custom parser for the proprietary format
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   Your organization is acquiring a software product from a supplier that has passed initial security questionnaires. During contract negotiations, the supplier refuses to allow your auditors to perform an on-site assessment of their development environment, citing confidentiality concerns. They offer to provide a summary of their security certifications instead. Your compliance team requires evidence that the supplier's secure coding practices are actually implemented. What is the most appropriate action?

   • AAccept the certification summary as sufficient evidence since it is an official attestation.
   • BRequire a third-party audit report (e.g., SOC 2 Type II) as a condition of the contract, with provisions for follow-up on any findings.
   • CTerminate the acquisition immediately because the supplier's refusal indicates a lack of security maturity.
   • DProceed with the acquisition and rely on post-deployment monitoring to detect any security issues.
   Reveal Solution Discussion Select an answer first