SaaS SaaS Security and Compliance 3

Question 1

What is multi-tenancy in SaaS and why is tenant isolation important?

Accepted Answer

A single application instance serving multiple customers, with isolation preventing one tenant from accessing another's data

Answer

Running separate servers for each customer to maximize performance

Answer

Offering multiple pricing tiers to different customer segments

Answer

Deploying software across multiple geographic regions

Question 2

What is penetration testing in the SaaS context?

Accepted Answer

Authorized simulated cyberattacks to identify security vulnerabilities

Answer

Testing application performance under maximum load

Answer

Monitoring user behavior for insider threats

Answer

Scanning code repositories for hardcoded credentials

Question 3

What does SIEM stand for and how is it used in SaaS security operations?

Accepted Answer

Security Information and Event Management — aggregates and analyzes security logs for threat detection

Answer

Software Integration and Event Monitoring — tracks SaaS API calls

Answer

SaaS Infrastructure and Encryption Management — manages keys

Answer

Service Identity and Entitlement Management — controls permissions

Question 4

Why is role-based access control (RBAC) considered a security best practice for SaaS platforms?

Accepted Answer

It restricts users to only the data and features their role requires, minimizing the blast radius of compromised accounts

Answer

It speeds up application load times by caching user permissions

Answer

It eliminates the need for multi-factor authentication

Answer

It automatically encrypts data based on user role

Question 5

What is a supply chain attack risk specific to SaaS companies that rely on third-party components?

Accepted Answer

A compromise of a third-party library or integration that propagates malicious code into the SaaS product

Answer

Vendors charging more than agreed in contracts

Answer

Slow API response times from external dependencies

Answer

Licensing conflicts between open-source components

Question 6

What is the primary purpose of audit logs in a SaaS application?

Accepted Answer

To provide an immutable record of user and system actions for compliance, forensics, and anomaly detection

Answer

To improve application performance by caching frequent queries

Answer

To track marketing campaign performance

Answer

To measure uptime and calculate SLA credits