SaaS SaaS Security and Compliance 2

Question 1

What is a SOC 2 Type I report?

Accepted Answer

A snapshot audit confirming that controls are suitably designed at a specific point in time

Answer

An audit covering controls over a minimum 6-month period

Answer

A penetration test report

Answer

A certification for cloud infrastructure providers only

Question 2

What does CASB stand for in SaaS security?

Accepted Answer

Cloud Access Security Broker

Answer

Centralized Application Security Baseline

Answer

Compliance and Security Benchmarking

Answer

Cloud Application Security Bridge

Question 3

Which of the following is a key component of Zero Trust security for SaaS environments?

Accepted Answer

Never trust, always verify — requiring authentication for every access request

Answer

Trusting all traffic inside the corporate VPN

Answer

Blocking all third-party SaaS integrations

Answer

Relying solely on perimeter firewalls

Question 4

What is data loss prevention (DLP) in the context of SaaS?

Accepted Answer

Technology that detects and prevents unauthorized sharing or exfiltration of sensitive data

Answer

A backup system that prevents data from being lost during outages

Answer

A redundancy mechanism that replicates data across multiple data centers

Answer

An encryption tool for SaaS API communications

Question 5

What is the purpose of a vulnerability disclosure policy (VDP) for a SaaS company?

Accepted Answer

To establish a process for security researchers to report vulnerabilities responsibly

Answer

To define how the company discloses its own security breaches to customers

Answer

To outline the company's patch deployment schedule

Answer

To list all known software vulnerabilities in a public registry

Question 6

Which US law requires publicly traded SaaS companies to disclose material cybersecurity incidents to investors?

Accepted Answer

SEC Cybersecurity Disclosure Rules

Answer

CCPA

Answer

FISMA

Answer

NIST CSF