CSLLP Supply Chain and Software Acquisition 2

Question 1

Which framework provides guidelines specifically for managing cybersecurity risks within the supply chain and is published by NIST?

Accepted Answer

NIST SP 800-161

Answer

NIST SP 800-161, 'Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations,' provides comprehensive guidance for managing supply chain cybersecurity risks.

Question 2

A company is evaluating a commercial off-the-shelf (COTS) product. Which security activity is MOST important before deployment?

Accepted Answer

Conducting a security assessment against defined security requirements and testing for known vulnerabilities

Answer

Assessing the COTS product against security requirements and testing for known vulnerabilities allows the organization to make an informed risk acceptance decision before deployment.

Question 3

What is the role of a 'trusted foundry' in hardware supply chain security?

Accepted Answer

A certified manufacturing facility that meets government standards for producing trustworthy hardware

Answer

A trusted foundry is a certified semiconductor or hardware manufacturing facility that meets rigorous government or industry standards, reducing the risk of hardware backdoors or tampering.

Question 4

Which contract clause BEST protects an organization if a software vendor suffers a security breach that exposes the organization's data?

Accepted Answer

Indemnification and breach notification clause

Answer

An indemnification and breach notification clause obligates the vendor to notify the organization of breaches and provides legal and financial recourse for resulting damages.

Question 5

In supply chain risk management, 'nth-party risk' refers to:

Accepted Answer

Security risk propagated through a vendor's own suppliers and subcontractors

Answer

Nth-party risk extends beyond direct (first-party) and immediate vendor (third-party) risks to include the security posture of the vendor's own supply chain and subcontractors.

CSLLP - Certified Secure Software Lifecycle Professional Practice Test

CSLLP - Certified Secure Software Lifecycle Professional Practice Test

CSLLP Supply Chain and Software Acquisition 2