Questão 65 — CompTIA SY0-701 CompTIA Security+ Certification Exam
A security analyst is evaluating a SaaS application that the human resources department would like to implement. The analyst requests a SOC 2 report from the SaaS vendor. Which of the following processes is the analyst most likely conducting?
- A. Internal audit
- B. Penetration testing
- C. Attestation
- D. Due diligence
Resposta correta:
D
Explicação
Explanation: Correct answer: D. Due diligence By requesting a SOC 2 report, the analyst is conducting a vendor risk assessment because: SOC 2 Reports:These reports document a vendor's security, availability, processing integrity, G confidentiality, and privacy controls Risk Evaluation:The assessment evaluates whether the SaaS vendor's security practices meet the G company's risk tolerance and requirements Third-Party Vetting:SOC 2 reports are prepared by independent auditors, providing objective verification G of vendor controls Compliance Verification:The report demonstrates the vendor's compliance with security standards G relevant to the industry Due Diligence:Requesting documentation before implementation is part of the due diligence process for G vendor selection Vendor risk assessment is the process of evaluating third-party security posture before integrating their services into the organization.
Quer todas as 907 questões por R$ 1,00?