SP Service Provider Cybersecurity and Risk Management 2 — Questions and Answers
Question 1: A Salesforce Service Provider discovers that a customer's org has an API integration that has been transmitting data to an unauthorized external endpoint for 30 days. What is the FIRST step in the incident response process?
- Immediately revoke all API keys in the affected org
- Contain the breach by disabling the compromised integration (Correct answer)
- Notify all affected customers within 24 hours
- Perform a full forensic audit before taking any action
Correct answer: Contain the breach by disabling the compromised integration
Containment is the first active step in incident response to stop ongoing data exfiltration before proceeding to eradication and recovery.
Question 2: Which Salesforce feature allows Service Providers to enforce that users can only access the org from specific IP address ranges?
- Trusted IP Ranges in Network Access settings (Correct answer)
- Login Flows with IP validation
- Permission Set IP restrictions
- Connected App IP policies
Correct answer: Trusted IP Ranges in Network Access settings
Trusted IP Ranges in the Network Access settings restrict logins to specific IP addresses, blocking access from unauthorized networks.
Question 3: A Service Provider is assessing a customer's Salesforce org for SOC 2 Type II compliance. Which Salesforce-native log is MOST useful for demonstrating continuous monitoring of user access events?
- Debug Logs
- Event Monitoring logs (Correct answer)
- Audit Trail (Setup Audit Trail)
- Login History
Correct answer: Event Monitoring logs
Event Monitoring provides detailed logs of user activity including logins, API calls, and data exports, making it ideal for SOC 2 continuous monitoring evidence.
Question 4: Under the Salesforce Shared Responsibility Model, which of the following is the customer's (and Service Provider's) responsibility — NOT Salesforce's?
- Physical data center security
- Platform availability and uptime
- User access management and data classification (Correct answer)
- Hypervisor and infrastructure patching
Correct answer: User access management and data classification
Under the shared responsibility model, customers and their Service Providers own user access control, data classification, and configuration security while Salesforce manages the underlying infrastructure.
Question 5: A Service Provider needs to reduce the risk of a compromised Salesforce admin account being used to export all customer data. Which combination of controls BEST addresses this?
- Strong password policy + login IP restrictions
- Multi-Factor Authentication (MFA) + Data Export restrictions via profiles (Correct answer)
- Session timeout settings + permission sets
- Login hours restrictions + field-level security
Correct answer: Multi-Factor Authentication (MFA) + Data Export restrictions via profiles
MFA prevents account takeover via credential theft, while restricting Data Export permissions via profiles limits what a compromised account can extract.
Question 6: A Service Provider's customer is subject to GDPR. A data subject requests deletion of their personal data stored in Salesforce. Which Salesforce capability is MOST relevant to fulfilling this 'Right to Erasure' request?
- Mass Delete Records tool
- Salesforce Privacy Center — Individual records and data action policies (Correct answer)
- Data Export Service with manual deletion
- GDPR compliance toggle in Security Settings
Correct answer: Salesforce Privacy Center — Individual records and data action policies
Salesforce Privacy Center enables Service Providers to manage Individual records, create data action policies, and fulfill data subject requests including erasure in compliance with GDPR.
Question 7: When conducting a risk assessment for a Salesforce implementation, a Service Provider identifies that a business-critical process relies on a single Salesforce admin with no documented succession plan. This is best categorized as which type of risk?
- Technical risk
- Operational / Key-person risk (Correct answer)
- Compliance risk
- Vendor risk
Correct answer: Operational / Key-person risk
Dependency on a single individual with no backup or succession plan is a classic operational key-person risk that threatens business continuity.
SP Service Provider Cybersecurity and Risk Management 2
A Salesforce Service Provider discovers that a customer's org has an API integration that has been transmitting data to an unauthorized external endpoint for 30 days.
What is the FIRST step in the incident response process?