SP Service Provider Cybersecurity and Risk Management 2

Question 1

A Salesforce Service Provider discovers that a customer's org has an API integration that has been transmitting data to an unauthorized external endpoint for 30 days. What is the FIRST step in the incident response process?

Accepted Answer

Contain the breach by disabling the compromised integration

Answer

Containment is the first active step in incident response to stop ongoing data exfiltration before proceeding to eradication and recovery.

Question 2

Which Salesforce feature allows Service Providers to enforce that users can only access the org from specific IP address ranges?

Accepted Answer

Trusted IP Ranges in Network Access settings

Answer

Trusted IP Ranges in the Network Access settings restrict logins to specific IP addresses, blocking access from unauthorized networks.

Question 3

A Service Provider is assessing a customer's Salesforce org for SOC 2 Type II compliance. Which Salesforce-native log is MOST useful for demonstrating continuous monitoring of user access events?

Accepted Answer

Event Monitoring logs

Answer

Event Monitoring provides detailed logs of user activity including logins, API calls, and data exports, making it ideal for SOC 2 continuous monitoring evidence.

Question 4

Under the Salesforce Shared Responsibility Model, which of the following is the customer's (and Service Provider's) responsibility — NOT Salesforce's?

Accepted Answer

User access management and data classification

Answer

Under the shared responsibility model, customers and their Service Providers own user access control, data classification, and configuration security while Salesforce manages the underlying infrastructure.

Question 5

A Service Provider needs to reduce the risk of a compromised Salesforce admin account being used to export all customer data. Which combination of controls BEST addresses this?

Accepted Answer

Multi-Factor Authentication (MFA) + Data Export restrictions via profiles

Answer

MFA prevents account takeover via credential theft, while restricting Data Export permissions via profiles limits what a compromised account can extract.

SP (Certified Service Provider) Practice Test

SP (Certified Service Provider) Practice Test

SP Service Provider Cybersecurity and Risk Management 2