SaaS SaaS Security and Compliance 2

Question 1

What is a SOC 2 Type I report?

Accepted Answer

A snapshot audit confirming that controls are suitably designed at a specific point in time

Answer

SOC 2 Type I evaluates whether a vendor's security controls are suitably designed at a specific point in time, unlike Type II which tests effectiveness over a period.

Question 2

What does CASB stand for in SaaS security?

Accepted Answer

Cloud Access Security Broker

Answer

A Cloud Access Security Broker (CASB) sits between users and SaaS providers to enforce security policies, visibility, and compliance.

Question 3

Which of the following is a key component of Zero Trust security for SaaS environments?

Accepted Answer

Never trust, always verify — requiring authentication for every access request

Answer

Zero Trust requires continuous verification of every user and device regardless of location, eliminating the concept of a trusted internal network.

Question 4

What is data loss prevention (DLP) in the context of SaaS?

Accepted Answer

Technology that detects and prevents unauthorized sharing or exfiltration of sensitive data

Answer

DLP in SaaS detects and prevents users from sharing, uploading, or exfiltrating sensitive data in unauthorized ways.

Question 5

What is the purpose of a vulnerability disclosure policy (VDP) for a SaaS company?

Accepted Answer

To establish a process for security researchers to report vulnerabilities responsibly

Answer

A VDP provides a clear, safe channel for security researchers to report discovered vulnerabilities to the SaaS company without fear of legal action.

SaaS Practice Test

SaaS Practice Test

SaaS SaaS Security and Compliance 2