SP Service Provider Cybersecurity and Risk Management 3 — Questions and Answers
Question 1: A Service Provider is setting up a Connected App for a customer's third-party integration. Which OAuth flow is MOST appropriate for a server-to-server integration with no user interaction?
- User-Agent Flow
- Web Server Flow (Authorization Code)
- JWT Bearer Token Flow (Correct answer)
- Device Flow
Correct answer: JWT Bearer Token Flow
The JWT Bearer Token Flow enables server-to-server authentication using a certificate-based assertion without requiring user credentials or interactive login.
Question 2: Which Salesforce security feature provides a detailed, tamper-evident record of configuration changes made in a Salesforce org, including who made them and when?
- Field History Tracking
- Setup Audit Trail (Correct answer)
- Debug Logs
- Change Data Capture
Correct answer: Setup Audit Trail
Setup Audit Trail records the last 180 days of configuration changes with user, timestamp, and change details, supporting forensic and compliance audits.
Question 3: A Service Provider is designing a Salesforce org for a healthcare customer. PHI (Protected Health Information) must not appear in email notifications. Which control BEST enforces this?
- Field-Level Security on PHI fields
- Email template restrictions via profiles
- Removing PHI merge fields from all email templates and workflow alerts (Correct answer)
- Encrypting all outbound emails via Shield
Correct answer: Removing PHI merge fields from all email templates and workflow alerts
Removing PHI merge fields from email templates and workflow alerts directly prevents PHI from being included in sent emails, addressing the root configuration risk.
Question 4: A Service Provider is evaluating whether to use Salesforce Shield Platform Encryption or Classic Encryption for a financial services customer. What is the key advantage of Shield Platform Encryption over Classic Encryption?
- Shield Encryption is free; Classic Encryption has an additional cost
- Shield Encryption works with more Salesforce features including search, workflow, and reports (Correct answer)
- Classic Encryption encrypts at rest and in transit; Shield only encrypts in transit
- Shield Encryption uses AES-128; Classic uses AES-256
Correct answer: Shield Encryption works with more Salesforce features including search, workflow, and reports
Shield Platform Encryption encrypts data at rest while maintaining compatibility with core Salesforce functionality like search, workflow rules, and reports, unlike Classic Encryption which breaks many features.
Question 5: During a security review, a Service Provider finds that a customer org has 47 active Salesforce users who have not logged in for over 180 days. What is the recommended remediation?
- Freeze the accounts and notify IT for review and deprovisioning (Correct answer)
- Delete all inactive accounts immediately
- Change passwords on all inactive accounts
- Transfer ownership of their records to an active admin
Correct answer: Freeze the accounts and notify IT for review and deprovisioning
Freezing inactive accounts stops unauthorized access while preserving data ownership, and flagging them for IT review ensures proper deprovisioning following access governance processes.
Question 6: A Service Provider's customer wants to prevent users from downloading data from Salesforce reports to CSV. Which setting accomplishes this?
- Disable the 'Export Reports' permission in user profiles/permission sets (Correct answer)
- Set all reports to read-only in the Report Builder
- Enable Shield Event Monitoring to block exports
- Restrict reports folder sharing to View Only
Correct answer: Disable the 'Export Reports' permission in user profiles/permission sets
Removing the 'Export Reports' system permission from profiles or permission sets prevents users from exporting report data to CSV or Excel.
Question 7: In the context of Salesforce Service Provider risk management, what does a 'dependency risk' on Salesforce AppExchange packages refer to?
- The risk that Salesforce raises AppExchange listing fees
- The risk that a managed package vendor is acquired, discontinues the product, or introduces a security vulnerability affecting the customer org (Correct answer)
- The risk that AppExchange packages slow down the org's performance
- The risk of installing too many packages exceeding governor limits
Correct answer: The risk that a managed package vendor is acquired, discontinues the product, or introduces a security vulnerability affecting the customer org
Third-party managed packages create vendor dependency risks including business continuity risk if the vendor discontinues the product and security risk if vulnerabilities are introduced through package updates.
SP Service Provider Cybersecurity and Risk Management 3
A Service Provider is setting up a Connected App for a customer's third-party integration.
Which OAuth flow is MOST appropriate for a server-to-server integration with no user interaction?