SP Service Provider Cybersecurity and Risk Management 3

Question 1

A Service Provider is setting up a Connected App for a customer's third-party integration. Which OAuth flow is MOST appropriate for a server-to-server integration with no user interaction?

Accepted Answer

JWT Bearer Token Flow

Answer

The JWT Bearer Token Flow enables server-to-server authentication using a certificate-based assertion without requiring user credentials or interactive login.

Question 2

Which Salesforce security feature provides a detailed, tamper-evident record of configuration changes made in a Salesforce org, including who made them and when?

Accepted Answer

Setup Audit Trail

Answer

Setup Audit Trail records the last 180 days of configuration changes with user, timestamp, and change details, supporting forensic and compliance audits.

Question 3

A Service Provider is designing a Salesforce org for a healthcare customer. PHI (Protected Health Information) must not appear in email notifications. Which control BEST enforces this?

Accepted Answer

Removing PHI merge fields from all email templates and workflow alerts

Answer

Removing PHI merge fields from email templates and workflow alerts directly prevents PHI from being included in sent emails, addressing the root configuration risk.

Question 4

A Service Provider is evaluating whether to use Salesforce Shield Platform Encryption or Classic Encryption for a financial services customer. What is the key advantage of Shield Platform Encryption over Classic Encryption?

Accepted Answer

Shield Encryption works with more Salesforce features including search, workflow, and reports

Answer

Shield Platform Encryption encrypts data at rest while maintaining compatibility with core Salesforce functionality like search, workflow rules, and reports, unlike Classic Encryption which breaks many features.

Question 5

During a security review, a Service Provider finds that a customer org has 47 active Salesforce users who have not logged in for over 180 days. What is the recommended remediation?

Accepted Answer

Freeze the accounts and notify IT for review and deprovisioning

Answer

Freezing inactive accounts stops unauthorized access while preserving data ownership, and flagging them for IT review ensures proper deprovisioning following access governance processes.

SP (Certified Service Provider) Practice Test

SP (Certified Service Provider) Practice Test

SP Service Provider Cybersecurity and Risk Management 3