SaaS SaaS Security and Compliance 3

Question 1

What is multi-tenancy in SaaS and why is tenant isolation important?

Accepted Answer

A single application instance serving multiple customers, with isolation preventing one tenant from accessing another's data

Answer

Multi-tenancy serves multiple customers from one application instance; tenant isolation ensures a security breach or misconfiguration for one customer does not expose another's data.

Question 2

What is penetration testing in the SaaS context?

Accepted Answer

Authorized simulated cyberattacks to identify security vulnerabilities

Answer

Penetration testing involves authorized ethical hackers attempting to exploit vulnerabilities in a SaaS application to discover and remediate them before attackers do.

Question 3

What does SIEM stand for and how is it used in SaaS security operations?

Accepted Answer

Security Information and Event Management — aggregates and analyzes security logs for threat detection

Answer

SIEM aggregates logs and security events from across the environment, applying analytics to detect threats, anomalies, and compliance violations in real time.

Question 4

Why is role-based access control (RBAC) considered a security best practice for SaaS platforms?

Accepted Answer

It restricts users to only the data and features their role requires, minimizing the blast radius of compromised accounts

Answer

RBAC ensures users have the least privilege necessary for their role, so a compromised account can only access data relevant to that role, limiting damage.

Question 5

What is a supply chain attack risk specific to SaaS companies that rely on third-party components?

Accepted Answer

A compromise of a third-party library or integration that propagates malicious code into the SaaS product

Answer

A supply chain attack targets a trusted third-party dependency (npm package, SDK, integration) to inject malicious code that then affects all downstream SaaS customers.

SaaS Practice Test

SaaS Practice Test

SaaS SaaS Security and Compliance 3