CSLLP Supply Chain and Software Acquisition 2

Question 1

Which framework provides guidelines specifically for managing cybersecurity risks within the supply chain and is published by NIST?

Accepted Answer

NIST SP 800-161

Answer

OWASP Top 10

Answer

ISO/IEC 27001

Answer

PCI DSS

Question 2

A company is evaluating a commercial off-the-shelf (COTS) product. Which security activity is MOST important before deployment?

Accepted Answer

Conducting a security assessment against defined security requirements and testing for known vulnerabilities

Answer

Rewriting the COTS product's source code to remove vulnerabilities

Answer

Requiring the vendor to open-source the product

Answer

Replacing all authentication modules with custom implementations

Question 3

What is the role of a 'trusted foundry' in hardware supply chain security?

Accepted Answer

A certified manufacturing facility that meets government standards for producing trustworthy hardware

Answer

A legal entity that holds escrow copies of vendor source code

Answer

An independent auditor that reviews vendor security practices

Answer

A cloud provider that hosts software in an isolated environment

Question 4

Which contract clause BEST protects an organization if a software vendor suffers a security breach that exposes the organization's data?

Accepted Answer

Indemnification and breach notification clause

Answer

Most-favored-nation pricing clause

Answer

Automatic renewal clause

Answer

Warranty disclaimer clause

Question 5

In supply chain risk management, 'nth-party risk' refers to:

Accepted Answer

Security risk propagated through a vendor's own suppliers and subcontractors

Answer

Risk from internal employees with privileged access

Answer

Risk associated with using outdated cryptographic algorithms

Answer

Regulatory risk from non-compliance with data protection laws

Question 6

Which technique allows an organization to verify that a software binary was compiled from a specific, unmodified source code version?

Accepted Answer

Reproducible builds

Answer

Fuzz testing

Answer

Dynamic application security testing (DAST)

Answer

Penetration testing

Question 7

When assessing a cloud service provider (CSP) as part of software acquisition, which document provides a standardized security assessment framework?

Accepted Answer

SOC 2 Type II report

Answer

ISO 9001 certification

Answer

PCI PA-DSS report

Answer

GDPR Data Processing Agreement