CSLLP Supply Chain and Software Acquisition 1 — Questions and Answers
Question 1: Which document formally defines the security requirements that a third-party software vendor must meet before their product can be integrated into an organization's environment?
- Service Level Agreement (SLA)
- Software Security Requirements Specification (SSRS) (Correct answer)
- Memorandum of Understanding (MOU)
- Statement of Work (SOW)
Correct answer: Software Security Requirements Specification (SSRS)
An SSRS formally captures the security requirements that a vendor's software must satisfy, serving as the contractual and technical baseline for third-party integration.
Question 2: What is the primary purpose of software composition analysis (SCA) in the context of supply chain security?
- Analyzing network traffic for malicious payloads
- Identifying open-source components and their known vulnerabilities within a codebase (Correct answer)
- Verifying that software binaries match their source code
- Monitoring runtime behavior of third-party libraries
Correct answer: Identifying open-source components and their known vulnerabilities within a codebase
SCA tools catalog open-source and third-party components in a codebase and cross-reference them against vulnerability databases to identify known risks.
Question 3: Which supply chain attack technique involves injecting malicious code into a software update mechanism before it reaches end users?
- SQL injection
- Watering hole attack
- Build pipeline compromise (Correct answer)
- Session hijacking
Correct answer: Build pipeline compromise
Compromising the build pipeline allows an attacker to insert malicious code that gets distributed to all downstream users through legitimate update channels.
Question 4: A Software Bill of Materials (SBOM) is best described as:
- A penetration testing report for third-party software
- A formal inventory of components, libraries, and dependencies that make up a software product (Correct answer)
- A financial summary of software licensing costs
- A list of approved software vendors for procurement
Correct answer: A formal inventory of components, libraries, and dependencies that make up a software product
An SBOM provides a comprehensive inventory of all components and dependencies in a software product, enabling organizations to assess supply chain risk and vulnerability exposure.
Question 5: Which acquisition practice BEST reduces the risk of counterfeit or tampered hardware and firmware in the supply chain?
- Purchasing exclusively from lowest-cost vendors
- Requiring vendors to provide source code escrow
- Procuring from vetted, trusted suppliers and verifying cryptographic integrity of firmware (Correct answer)
- Disabling unused hardware features after delivery
Correct answer: Procuring from vetted, trusted suppliers and verifying cryptographic integrity of firmware
Using trusted suppliers with established verification processes and validating firmware integrity via cryptographic signatures reduces the risk of counterfeit or backdoored hardware.
Question 6: What does the term 'vendor lock-in' refer to in the context of software acquisition security?
- Preventing vendors from accessing proprietary source code
- A situation where dependency on a single vendor creates strategic and operational risk (Correct answer)
- Enforcing strict access controls on vendor personnel
- Locking vendor credentials after multiple failed login attempts
Correct answer: A situation where dependency on a single vendor creates strategic and operational risk
Vendor lock-in creates risk when an organization cannot easily switch providers, leaving it exposed if the vendor is compromised, discontinues the product, or fails to meet security obligations.
Question 7: During software acquisition, which practice helps ensure that delivered software has not been tampered with during transit or distribution?
- Code obfuscation by the vendor
- Verification of cryptographic hash values or digital signatures against vendor-published checksums (Correct answer)
- Runtime application self-protection (RASP) deployment
- Mandatory penetration testing before delivery
Correct answer: Verification of cryptographic hash values or digital signatures against vendor-published checksums
Comparing cryptographic hashes or validating digital signatures against vendor-published values confirms that the software package has not been altered since it was signed by the vendor.
CSLLP Supply Chain and Software Acquisition 1
Which document formally defines the security requirements that a third-party software vendor must meet before their product can be integrated into an organization's environment?