CSLLP Supply Chain and Software Acquisition 3

Question 1

Which practice BEST mitigates the risk of malicious packages being introduced through open-source dependencies?

Accepted Answer

Using a private artifact repository with vetted, approved packages and automated vulnerability scanning

Answer

A private artifact repository with pre-approved packages and continuous vulnerability scanning creates a controlled supply chain gateway that prevents malicious or vulnerable packages from entering the build environment.

Question 2

What is 'typosquatting' in the context of software supply chain attacks?

Accepted Answer

Publishing malicious packages with names nearly identical to popular legitimate packages

Answer

Typosquatting in supply chain attacks involves publishing malicious packages with names that closely mimic popular libraries, exploiting developer typographical errors during package installation.

Question 3

A right-to-audit clause in a vendor contract is PRIMARILY intended to:

Accepted Answer

Give the acquiring organization the right to inspect the vendor's security practices and controls

Answer

A right-to-audit clause grants the customer the contractual right to inspect, assess, or have a third party assess the vendor's security controls, ensuring ongoing compliance with security requirements.

Question 4

Which U.S. executive order significantly elevated software supply chain security requirements for federal government software procurement?

Accepted Answer

Executive Order 14028 on Improving the Nation's Cybersecurity

Answer

EO 14028, signed in May 2021, specifically mandated enhanced software supply chain security practices including SBOM requirements, secure development attestations, and security testing for software sold to the federal government.

Question 5

In the context of secure software acquisition, what does 'security by contract' mean?

Accepted Answer

Embedding specific, enforceable security requirements and obligations into vendor contracts

Answer

Security by contract means explicitly incorporating measurable security requirements, standards compliance, audit rights, and breach notification obligations into vendor agreements to make security legally enforceable.

CSLLP - Certified Secure Software Lifecycle Professional Practice Test

CSLLP - Certified Secure Software Lifecycle Professional Practice Test

CSLLP Supply Chain and Software Acquisition 3