Ensure and Verify Supplier Security Requirements in the Acquisition Process CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   Your organization is evaluating two open-source libraries for a new application. Library A is community-maintained with frequent releases but no formal support. Library B is commercially backed with a paid support contract and a defined maintenance schedule. Your team has limited security expertise and requires timely assistance with vulnerability remediation. Which factor is most important in this decision?

   • AThe popularity of the library in the developer community
   • BThe license type of each library
   • CThe availability of a formal support structure and defined response times
   • DThe number of contributors to each library
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   When a supplier provides a software component, which security testing activity is typically the customer's responsibility under the shared responsibility model?

   • ATesting the component's integration with the customer's own systems and data
   • BTesting the supplier's physical data center security
   • CTesting the supplier's internal development environment
   • DTesting the supplier's employee background checks
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A software vendor you rely on for a critical component has just disclosed a vulnerability that affects your production environment. Your incident response team needs to understand the vendor's remediation timeline and whether they will provide a patch. Where should this information be defined to ensure a coordinated response?

   • AIn the vendor's marketing materials and product documentation
   • BIn the contractual agreement with the vendor
   • CIn the vendor's public vulnerability disclosure policy
   • DIn the incident response plan of your organization
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   Your organization is procuring a cloud-based application from a vendor. The vendor provides the application and the underlying infrastructure, but your organization is responsible for configuring user access and managing client-side endpoints. During a security review, your team wants to ensure that the vendor's security testing covers the application layer. Which document should clearly define this responsibility?

   • AThe vendor's marketing brochure
   • BThe shared responsibility matrix
   • CThe service level agreement (SLA)
   • DThe data processing agreement (DPA)
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A supplier with a generally good security track record has experienced a significant security incident. During the incident, the supplier failed to notify your organization within the contractual 24-hour window, and their initial report was incomplete. Your organization is now considering whether to renew the contract. What is the most balanced approach?

   • ARenew the contract but require the supplier to improve their incident notification process
   • BRenew the contract without changes because the supplier has a good track record
   • CTerminate the contract immediately due to the notification failure
   • DConduct a thorough review of the supplier's incident response and notification procedures before making a renewal decision
   Reveal Solution Discussion Select an answer first