CAP Supply Chain Risk Management 2

Question 1

What is a 'trusted supplier' program in the context of federal ICT procurement?

Accepted Answer

A vetting process to identify and use vendors who meet security standards and have demonstrated trustworthiness

Answer

Trusted supplier programs establish criteria for vetting vendors' security practices, integrity, and supply chain controls before purchasing their products.

Question 2

What supply chain attack vector was demonstrated by the SolarWinds Orion incident?

Accepted Answer

Malicious code injected into a legitimate software update distributed to thousands of customers

Answer

The SolarWinds attack inserted malicious code (SUNBURST) into legitimate software updates that were then distributed and trusted by customers.

Question 3

What is the purpose of a vendor risk assessment in ICT supply chain risk management?

Accepted Answer

To evaluate a third-party vendor's security practices, financial stability, and ability to protect government data

Answer

Vendor risk assessments evaluate whether suppliers have adequate security controls, business continuity plans, and integrity measures to be trusted partners.

Question 4

Which federal law prohibits the use of telecommunications equipment from specific companies deemed national security risks in federal systems?

Accepted Answer

National Defense Authorization Act (NDAA) Section 889

Answer

NDAA Section 889 prohibits federal agencies from procuring or using telecommunications equipment from companies like Huawei and ZTE due to national security concerns.

Question 5

What does 'hardware integrity verification' involve in supply chain risk management?

Accepted Answer

Inspecting physical hardware for signs of tampering or counterfeit components before deployment

Answer

Hardware integrity verification checks for physical tampering, counterfeit components, and unauthorized modifications that could introduce security risks.

CAP - Certified Accreditation Professional Practice Test

CAP - Certified Accreditation Professional Practice Test

CAP Supply Chain Risk Management 2