Ensure and Verify Supplier Security Requirements in the Acquisition Process CSSLP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which requirement is typically specified in a supplier contract regarding vulnerability and incident notification?

   • AThe supplier must notify the customer within a defined timeframe after confirming a vulnerability or incident that affects the customer
   • BThe supplier must wait until the customer requests information before reporting any incident
   • CThe supplier must publicly disclose all vulnerabilities immediately upon discovery
   • DThe supplier must only report incidents that result in data loss
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   During a supplier security audit, which activity is most directly associated with verifying that the supplier follows its documented secure software development practices?

   • AReviewing the supplier's code repository for the presence of automated security scanning tools
   • BVerifying that the supplier's website displays a security certification badge
   • CChecking that the supplier's employees have signed non-disclosure agreements
   • DConfirming that the supplier has a published information security policy
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   When evaluating a supplier's maintenance and support model, which factor is most important to consider when comparing community-supported open-source software to commercially supported software?

   • AThe availability of guaranteed response times and security patch delivery
   • BThe number of features in the software
   • CThe popularity of the software in the developer community
   • DThe cost of the software license
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   Your organization is considering a commercial software product that is built on an open-source core. The commercial vendor offers a support contract, but the open-source community also provides patches. Your team wants to ensure that security vulnerabilities are fixed promptly. What is the most important consideration?

   • AThe commercial vendor's commitment to backporting security fixes to the version you use
   • BThe speed of the open-source community in releasing patches
   • CThe popularity of the open-source project
   • DThe license of the open-source core
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   Your organization has a contractual requirement that a supplier must notify you within 24 hours of discovering a security incident. The supplier has just informed you of a breach that occurred four days ago. Your incident response team needs to understand the scope of the breach and what data was affected. What is the most important immediate action?

   • ATerminate the contract with the supplier immediately
   • BDisconnect all systems connected to the supplier
   • CRequest a detailed incident report from the supplier, including the timeline and affected data
   • DContact your legal team to discuss breach notification obligations
   Reveal Solution Discussion Select an answer first