A SaaS vendor that hosts the city’s permit portal sends its own penetration-test report as proof of security. What is the most appropriate way for the city to treat that evidence?
Select an answer to reveal the explanation.
Short Explanation
Vendor-run tests are like a restaurant grading its own kitchen—helpful, but not the whole story. Use the report, then check who tested what, how independent they were, and whether fixes actually landed.
Full Explanation
Vendor-supplied penetration testing can inform municipal third-party risk decisions, but it is not automatic assurance. The correct approach treats the SaaS permit-portal report as useful input while still verifying engagement scope, tester independence, residual findings, and whether remediation was completed and validated. Cities routinely receive self-funded or vendor-arranged tests; those packets still need the same scrutiny applied to any supplier evidence before they influence procurement, continuous monitoring, or exception decisions.
Accepting the report as conclusive and skipping further third-party review confuses a document with a complete control. Vendor interests, limited scopes, outdated test windows, or unfixed critical issues can leave the city exposed even when a glossy PDF exists. Discarding all vendor evidence because only city-run scans are 'allowed' is also wrong: Security+ and practical vendor-risk programs expect you to use supplier artifacts thoughtfully, not reject them on principle. Immediately replacing a vendor whenever any self-assessment appears overreacts; self-assessments and vendor-funded tests are common starting points and should drive verification, not automatic termination.
Exam caveat: SY0-701 third-party risk questions often tempt candidates toward either blind trust or total rejection. The scoring answer is usually verify and integrate—scope, independence, findings, remediation—rather than extreme discard-or-replace postures.
Operational check: for each vendor pentest packet, record who commissioned the test, rules of engagement, systems in and out of scope, tester affiliation, report date, severity summary, and closed-loop evidence that critical and high findings were fixed or formally risk-accepted by the city. Re-test or compensate before go-live or renewal when material gaps remain.