SP Service Provider Legal and Compliance 3

Question 1

Which Salesforce policy requires Service Providers to immediately report a known security vulnerability found in a client's production Salesforce org?

Accepted Answer

Salesforce Responsible Disclosure Policy

Answer

Salesforce's Responsible Disclosure Policy outlines the proper process for reporting security vulnerabilities to protect customers and the platform.

Question 2

A client operating in the healthcare sector wants a Salesforce implementation. Which compliance framework would most directly govern how PHI is handled within the platform?

Accepted Answer

HIPAA

Answer

HIPAA (Health Insurance Portability and Accountability Act) governs the handling of Protected Health Information (PHI) for healthcare-related entities.

Question 3

When a Salesforce Service Provider uses a third-party tool integrated with a client's org, who bears primary responsibility for ensuring that tool's compliance with the client's DPA?

Accepted Answer

The Service Provider, as it introduced the tool into the engagement

Answer

The Service Provider is responsible for vetting and ensuring third-party tools it introduces meet the client's contractual and compliance obligations.

Question 4

Which element is REQUIRED in a Salesforce Service Provider's engagement contract to satisfy GDPR Article 28 when processing EU personal data?

Accepted Answer

A Data Processing Agreement specifying processing instructions

Answer

GDPR Article 28 mandates that controllers use only processors who provide sufficient guarantees, formalized through a Data Processing Agreement with specific required clauses.

Question 5

A Service Provider wants to use client data from a completed project to improve its own internal AI models. Under standard contractual terms, this would typically:

Accepted Answer

Require explicit written consent from the client

Answer

Using client data for the SP's own purposes beyond the contracted scope requires explicit written consent, as it exceeds the authorized processing purpose.

SP (Certified Service Provider) Practice Test

SP (Certified Service Provider) Practice Test

SP Service Provider Legal and Compliance 3