CAP Supply Chain Risk Management 1

Question 1

What is Information and Communications Technology Supply Chain Risk Management (ICT SCRM)?

Accepted Answer

The process of identifying, assessing, and mitigating risks associated with the global supply chain for IT products and services

Answer

ICT SCRM addresses risks arising from the complex global supply chain, including malicious tampering, counterfeits, and vendor vulnerabilities.

Question 2

Which NIST publication provides guidance specifically on supply chain risk management for federal systems?

Accepted Answer

NIST SP 800-161

Answer

NIST SP 800-161 provides guidance on identifying and mitigating supply chain risks for federal information systems and organizations.

Question 3

Which NIST SP 800-53 control family specifically addresses supply chain risk management?

Accepted Answer

SR (Supply Chain Risk Management)

Answer

The SR control family, added in NIST SP 800-53 Revision 5, specifically addresses supply chain risk management controls.

Question 4

What is a 'counterfeit component' threat in the context of ICT supply chain risk?

Accepted Answer

Hardware or software that is fraudulently represented as genuine but may contain malicious functionality or quality defects

Answer

Counterfeit components are fake products that may contain backdoors, poor quality components, or malicious code inserted during manufacturing.

Question 5

What is a Software Bill of Materials (SBOM) and why is it important for supply chain security?

Accepted Answer

A formal record of software components and their dependencies, enabling organizations to identify vulnerable libraries quickly

Answer

An SBOM provides transparency into a software product's components, helping organizations rapidly identify exposure when vulnerabilities like Log4Shell are discovered.

CAP - Certified Accreditation Professional Practice Test

CAP - Certified Accreditation Professional Practice Test

CAP Supply Chain Risk Management 1