Integrate Service Level Objectives and Service-Level Agreements (SLA) (e.g., Maintenance, Performance, Availability, Qualified Personnel) CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Why might an SLA include a performance metric like throughput?

   • ATo guarantee that no security incidents occur.
   • BTo define the maximum number of users allowed on the system.
   • CTo specify the storage capacity of the system.
   • DTo ensure the system can handle the expected volume of transactions.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An e-commerce company has an SLA with its hosting provider that includes a monthly maintenance window from 2:00 AM to 4:00 AM on Sundays. During a recent security audit, the company discovered that critical security patches were not applied during the last maintenance window because the provider ran out of time. What should the company do to ensure that security patches are applied in a timely manner?

   • AAccept the risk and wait for the next scheduled maintenance window
   • BSwitch to a provider that offers 24/7 patching without a maintenance window
   • CNegotiate an additional maintenance window or a separate emergency patching clause in the SLA
   • DIncrease the length of the existing maintenance window to 6 hours
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   How does an availability target in an SLA relate to security?

   • AIt ensures that security controls are never disabled.
   • BIt guarantees that all security patches are applied without downtime.
   • CIt eliminates the need for incident response planning.
   • DIt requires the implementation of redundancy and failover mechanisms to meet uptime commitments.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A bank is outsourcing its customer support application to a third-party provider. The bank requires that all support personnel who handle customer data have passed a background check and hold a recognized security certification. Which SLA component should the bank include to enforce this requirement?

   • AAn availability clause requiring 99.9% uptime for the support application
   • BA data retention clause specifying how long customer data is stored
   • CA qualified personnel clause specifying the required certifications and background checks
   • DA performance clause defining the average handle time for support calls
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A healthcare SaaS provider is negotiating a contract with a hospital. The hospital requires that the provider guarantee 99.9% uptime for the patient portal, with a maximum response time of 2 seconds for critical transactions, and that all support staff handling PHI hold a current security certification. The provider wants to document these commitments in a formal contract. Which document should the provider and hospital sign?

   • AA security policy that specifies the technical controls for protecting PHI
   • BA service-level objective (SLO) that defines the internal targets for uptime and response time
   • CA memorandum of understanding (MOU) that outlines the general intent to provide reliable service
   • DA service-level agreement (SLA) that includes the uptime, response time, and personnel certification requirements
   Reveal Solution Discussion Select an answer first