Ensure and Verify Supplier Security Requirements in the Acquisition Process CSSLP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   Your organization is evaluating a supplier that has a strong security track record but has recently been acquired by a larger company. The acquisition has led to changes in the supplier's leadership and development processes. What is the most prudent action during the acquisition evaluation?

   • ARe-evaluate the supplier's current security practices and any changes resulting from the acquisition
   • BRequest a lower price to compensate for the uncertainty
   • CAssume the supplier's security practices remain unchanged because of their strong track record
   • DDelay the acquisition decision until the supplier's new leadership is established
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Why is it important to evaluate a supplier's security track record before entering into an acquisition?

   • ATo ensure the supplier has a large number of customers
   • BTo verify that the supplier is profitable
   • CTo negotiate a lower price for the software
   • DTo predict the supplier's future security performance and identify potential risks
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   Your organization is integrating a new SaaS application into your security operations. The vendor provides logs of user activity and security events, but your SIEM team is struggling to correlate these logs with other internal data. What is the most critical requirement to address this issue?

   • ARequire the vendor to send logs in real time
   • BAsk the vendor to provide a monthly summary report
   • CDefine a common correlation key such as user ID or session ID in the log schema
   • DEnsure the logs are in a standard format such as CEF or JSON
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which action is most appropriate for an organization to take when a supplier security audit reveals that the supplier has not followed its own secure coding standards in a delivered component?

   • AAsk the supplier to sign a new non-disclosure agreement
   • BTerminate the contract immediately without further discussion
   • CIgnore the finding because the component passed functional testing
   • DDocument the finding and require the supplier to provide a corrective action plan
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   Your organization is considering a supplier for a new authentication service. The supplier has had two public data breaches in the past three years, but they have since overhauled their security program and obtained ISO 27001 certification. Your team is divided on whether to proceed. What is the most balanced approach?

   • AReject the supplier solely based on their breach history
   • BConduct a detailed assessment of their current security practices and incident response history before deciding
   • CRequest a discount as compensation for the breach history
   • DProceed without further investigation because they are now certified
   Reveal Solution Discussion Select an answer first