CSLLP Supply Chain and Software Acquisition

Question 1

Which document formally defines the security requirements that a third-party software vendor must meet before their product can be integrated into an organization's environment?

Accepted Answer

Software Security Requirements Specification (SSRS)

Answer

An SSRS formally captures the security requirements that a vendor's software must satisfy, serving as the contractual and technical baseline for third-party integration.

Question 2

What is the primary purpose of software composition analysis (SCA) in the context of supply chain security?

Accepted Answer

Identifying open-source components and their known vulnerabilities within a codebase

Answer

SCA tools catalog open-source and third-party components in a codebase and cross-reference them against vulnerability databases to identify known risks.

Question 3

Which supply chain attack technique involves injecting malicious code into a software update mechanism before it reaches end users?

Accepted Answer

Build pipeline compromise

Answer

Compromising the build pipeline allows an attacker to insert malicious code that gets distributed to all downstream users through legitimate update channels.

Question 4

A Software Bill of Materials (SBOM) is best described as:

Accepted Answer

A formal inventory of components, libraries, and dependencies that make up a software product

Answer

An SBOM provides a comprehensive inventory of all components and dependencies in a software product, enabling organizations to assess supply chain risk and vulnerability exposure.

Question 5

Which acquisition practice BEST reduces the risk of counterfeit or tampered hardware and firmware in the supply chain?

Accepted Answer

Procuring from vetted, trusted suppliers and verifying cryptographic integrity of firmware

Answer

Using trusted suppliers with established verification processes and validating firmware integrity via cryptographic signatures reduces the risk of counterfeit or backdoored hardware.

CSLLP - Certified Secure Software Lifecycle Professional Practice Test

CSLLP - Certified Secure Software Lifecycle Professional Practice Test

CSLLP Supply Chain and Software Acquisition