CSLLP Supply Chain and Software Acquisition 3

Question 1

Which practice BEST mitigates the risk of malicious packages being introduced through open-source dependencies?

Accepted Answer

Using a private artifact repository with vetted, approved packages and automated vulnerability scanning

Answer

Prohibiting all use of open-source software

Answer

Requiring developers to manually review all open-source licenses

Answer

Storing open-source packages on a USB drive disconnected from the internet

Question 2

What is 'typosquatting' in the context of software supply chain attacks?

Accepted Answer

Publishing malicious packages with names nearly identical to popular legitimate packages

Answer

Registering domain names similar to legitimate ones to intercept traffic

Answer

Exploiting URL encoding to bypass input validation

Answer

Injecting malicious content into website form fields

Question 3

A right-to-audit clause in a vendor contract is PRIMARILY intended to:

Accepted Answer

Give the acquiring organization the right to inspect the vendor's security practices and controls

Answer

Allow the vendor to audit the customer's usage of licensed software

Answer

Establish the maximum penalty for contract breaches

Answer

Define the software update and patch delivery schedule

Question 4

Which U.S. executive order significantly elevated software supply chain security requirements for federal government software procurement?

Accepted Answer

Executive Order 14028 on Improving the Nation's Cybersecurity

Answer

Executive Order 13636 on Improving Critical Infrastructure Cybersecurity

Answer

Executive Order 13800 on Strengthening the Cybersecurity of Federal Networks

Answer

Executive Order 13587 on Structural Reforms to Improve the Security of Classified Networks

Question 5

In the context of secure software acquisition, what does 'security by contract' mean?

Accepted Answer

Embedding specific, enforceable security requirements and obligations into vendor contracts

Answer

Purchasing commercial security software to protect organizational assets

Answer

Requiring vendors to sign non-disclosure agreements before sharing security information

Answer

Using contractual penalties as the sole mechanism to enforce software quality

Question 6

Which activity is MOST critical when onboarding a new software development outsourcing partner?

Accepted Answer

Conducting security due diligence, establishing secure development requirements, and defining data handling protocols

Answer

Sharing full access to the organization's production environment for testing

Answer

Allowing the partner to define their own security standards independently

Answer

Requiring the partner to use only the organization's IDE and version control tools

Question 7

What is the MAIN security concern with using abandoned or unmaintained open-source libraries?

Accepted Answer

Newly discovered vulnerabilities will not receive patches, leaving applications permanently exposed

Answer

They are more expensive to license than commercial alternatives

Answer

They are incompatible with modern programming languages

Answer

They violate software export control regulations