CAP Supply Chain Risk Management 3

Question 1

What is a 'developer security' requirement in the context of supply chain risk management?

Accepted Answer

Requiring software developers and vendors to follow secure coding practices, conduct code reviews, and provide security testing evidence

Answer

Developer security requirements ensure that vendors build security into their products from the start through secure development lifecycle practices.

Question 2

What federal acquisition regulation clause requires contractors to report cyber incidents affecting federal information?

Accepted Answer

DFARS 252.204-7012 (for DoD contracts)

Answer

DFARS 252.204-7012 requires DoD contractors to implement NIST SP 800-171 controls and report cyber incidents affecting covered defense information within 72 hours.

Question 3

What is the purpose of a 'criticality analysis' in supply chain risk management?

Accepted Answer

To identify which system components, suppliers, and supply chain elements are most critical to mission success and require the most protection

Answer

Criticality analysis prioritizes supply chain protection efforts by identifying which components, if compromised, would have the greatest mission impact.

Question 4

What supply chain risk does 'open source software' present that proprietary software does not?

Accepted Answer

Anyone can introduce malicious code via pull requests or dependency confusion attacks targeting public package repositories

Answer

Open source supply chain attacks exploit the ability to inject malicious code into widely used libraries or impersonate legitimate packages in public repositories.

Question 5

How should organizations manage the risk of 'end-of-life' (EOL) software and hardware components in the supply chain?

Accepted Answer

By tracking EOL dates, planning replacements before support ends, and implementing compensating controls if immediate replacement is not possible

Answer

EOL components no longer receive security patches, so proactive replacement planning and compensating controls are essential to manage the associated risk.

CAP - Certified Accreditation Professional Practice Test

CAP - Certified Accreditation Professional Practice Test

CAP Supply Chain Risk Management 3