An organization has purchased a new cloud-based application from a vendor. Which of the following should be the FIRST consideration when implementing the system?

The correct answer is B. Ensuring vendor default accounts and passwords have been disabled. Vendor default accounts and passwords are publicly known or easily guessable, making them a top attack vector. Disabling or changing them must be the first action taken during implementation because the system is vulnerable from the moment it is provisioned. This is a…

Submitted by cyberguy42· Apr 18, 2026Information Systems Acquisition, Development, and Implementation

Question

Options

ADeleting the old copies of the program from escrow to avoid wrong versions
BEnsuring vendor default accounts and passwords have been disabled
CVerifying that the vendor is meeting maintenance agreements
DPreventing alterations to the source code during implementation

How the community answered

(25 responses)

A
8% (2)
B
88% (22)
D
4% (1)

Explanation

Vendor default accounts and passwords are publicly known or easily guessable, making them a top attack vector. Disabling or changing them must be the first action taken during implementation because the system is vulnerable from the moment it is provisioned. This is a foundational CIS Control and is emphasized in frameworks like NIST and ISO 27001. Option A (deleting escrow copies) is premature and potentially harmful. Option C (maintenance agreements) is an ongoing operational concern. Option D (source code integrity) is less relevant for a vendor-managed cloud application where the customer typically does not have access to the source code.

Topics

#Cloud Security#System Implementation#Default Accounts#Security Best Practices

Community Discussion

No community discussion yet for this question.

Full CISA Practice