Support Contractual Requirements (e.g., Intellectual Property Ownership, Code Escrow, Liability, Warranty, End-User License Agreement (EULA), Service-Level Agreements (SLA)) CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A software vendor is negotiating a contract with a large financial institution. The institution demands that the vendor indemnify it against all third-party IP infringement claims arising from the software. The vendor's counsel is concerned about unlimited exposure, especially because the institution will integrate the software into a larger platform with third-party components. Which indemnification clause best balances the vendor's risk and the institution's need for protection?

   • AVendor agrees to indemnify the institution only for claims arising from the vendor's willful misconduct, with all other claims being the institution's sole responsibility.
   • BVendor indemnifies the institution for infringement claims, but the clause excludes liability for infringements caused by the institution's modifications, combinations with third-party products, or use of the software in a manner not contemplated by the agreement.
   • CVendor caps its total indemnification liability at the amount paid by the institution for the software license, with no exclusions for customer modifications.
   • DVendor provides an unlimited, uncapped indemnity for all third-party IP claims, with no exclusions for modifications or combinations, and agrees to defend the institution at the vendor's sole expense.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company is deploying a software product that includes a EULA with a 'shrink-wrap' or 'click-through' agreement. The company's procurement team wants to ensure the EULA is enforceable. Which factor is most important for the enforceability of the EULA?

   • AThe EULA is written in a highly technical legal language that is precise and unambiguous.
   • BThe EULA is included in the software's installation package and is displayed during the installation process.
   • CThe EULA is filed with a government agency to be registered as a public document.
   • DThe user is given a clear opportunity to review the EULA terms before accepting them, and acceptance is required before installation or use.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is negotiating an SLA with a SaaS provider. The company's compliance team requires that the provider's data centers be located within the country where the company operates. The provider's standard SLA does not specify data center locations. Which action should the company take?

   • ARequest a copy of the provider's SOC 2 report to verify data center locations.
   • BAccept the standard SLA and assume the provider will store data in the company's country because it is a global provider.
   • CRely on the provider's general commitment to 'best-in-class security' in the SLA.
   • DAdd a specific SLA provision requiring the provider to store and process all data within the specified country, with a remedy for non-compliance.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A software vendor is negotiating a contract with a customer. The customer wants the vendor to be liable for any data breach caused by a vulnerability in the vendor's software. The vendor wants to limit its liability. Which clause is the most effective way for the vendor to limit its exposure while still providing some protection to the customer?

   • AA clause stating the vendor's liability is limited to the cost of repairing or replacing the defective software, with no cap on consequential damages.
   • BA clause stating the vendor is not liable for any damages arising from the use of the software, regardless of the cause.
   • CA limitation of liability clause capping the vendor's total liability at the fees paid by the customer over the preceding 12 months, with a mutual exclusion of consequential damages.
   • DA clause stating the customer must purchase cyber insurance to cover any losses from a data breach, and the vendor has no liability.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is deploying a commercial software product to 500 employees. The vendor's EULA states the license is granted for 'one user' and prohibits sharing login credentials. The company's IT manager wants to ensure compliance. Which action is the most appropriate?

   • APurchase 500 individual licenses, one for each employee who will use the software.
   • BPurchase 500 licenses but only after confirming with the vendor that the EULA permits installation on multiple devices per user.
   • CPurchase one license and install the software on a central server accessible to all employees.
   • DPurchase 50 licenses and instruct employees to share credentials to reduce costs.
   Reveal Solution Discussion Select an answer first