CSLLP Supply Chain and Software Acquisition 2 — Questions and Answers
Question 1: Which framework provides guidelines specifically for managing cybersecurity risks within the supply chain and is published by NIST?
- OWASP Top 10
- NIST SP 800-161 (Correct answer)
- ISO/IEC 27001
- PCI DSS
Correct answer: NIST SP 800-161
NIST SP 800-161, 'Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations,' provides comprehensive guidance for managing supply chain cybersecurity risks.
Question 2: A company is evaluating a commercial off-the-shelf (COTS) product. Which security activity is MOST important before deployment?
- Rewriting the COTS product's source code to remove vulnerabilities
- Conducting a security assessment against defined security requirements and testing for known vulnerabilities (Correct answer)
- Requiring the vendor to open-source the product
- Replacing all authentication modules with custom implementations
Correct answer: Conducting a security assessment against defined security requirements and testing for known vulnerabilities
Assessing the COTS product against security requirements and testing for known vulnerabilities allows the organization to make an informed risk acceptance decision before deployment.
Question 3: What is the role of a 'trusted foundry' in hardware supply chain security?
- A legal entity that holds escrow copies of vendor source code
- A certified manufacturing facility that meets government standards for producing trustworthy hardware (Correct answer)
- An independent auditor that reviews vendor security practices
- A cloud provider that hosts software in an isolated environment
Correct answer: A certified manufacturing facility that meets government standards for producing trustworthy hardware
A trusted foundry is a certified semiconductor or hardware manufacturing facility that meets rigorous government or industry standards, reducing the risk of hardware backdoors or tampering.
Question 4: Which contract clause BEST protects an organization if a software vendor suffers a security breach that exposes the organization's data?
- Indemnification and breach notification clause (Correct answer)
- Most-favored-nation pricing clause
- Automatic renewal clause
- Warranty disclaimer clause
Correct answer: Indemnification and breach notification clause
An indemnification and breach notification clause obligates the vendor to notify the organization of breaches and provides legal and financial recourse for resulting damages.
Question 5: In supply chain risk management, 'nth-party risk' refers to:
- Risk from internal employees with privileged access
- Security risk propagated through a vendor's own suppliers and subcontractors (Correct answer)
- Risk associated with using outdated cryptographic algorithms
- Regulatory risk from non-compliance with data protection laws
Correct answer: Security risk propagated through a vendor's own suppliers and subcontractors
Nth-party risk extends beyond direct (first-party) and immediate vendor (third-party) risks to include the security posture of the vendor's own supply chain and subcontractors.
Question 6: Which technique allows an organization to verify that a software binary was compiled from a specific, unmodified source code version?
- Fuzz testing
- Reproducible builds (Correct answer)
- Dynamic application security testing (DAST)
- Penetration testing
Correct answer: Reproducible builds
Reproducible builds ensure that compiling the same source code with the same tools always produces bit-for-bit identical binaries, allowing independent verification that no tampering occurred during the build process.
Question 7: When assessing a cloud service provider (CSP) as part of software acquisition, which document provides a standardized security assessment framework?
- SOC 2 Type II report (Correct answer)
- ISO 9001 certification
- PCI PA-DSS report
- GDPR Data Processing Agreement
Correct answer: SOC 2 Type II report
A SOC 2 Type II report provides an independent auditor's assessment of a service provider's security controls over a defined period, making it a key document for CSP security due diligence.
CSLLP Supply Chain and Software Acquisition 2
Which framework provides guidelines specifically for managing cybersecurity risks within the supply chain and is published by NIST?