ISP Supply Chain Security & Vendor Management 3

Question 1

Which of the following BEST mitigates the risk of a software supply chain attack, such as the SolarWinds-type attack?

Accepted Answer

Implementing software bill of materials (SBOM) reviews and code integrity verification before deployment

Answer

Requiring vendors to use only open-source software

Answer

Banning all software updates from third-party vendors

Answer

Using a single antivirus product on all systems

Question 2

An industrial security professional is reviewing a vendor's security self-assessment. Which of the following responses would be the GREATEST red flag?

Accepted Answer

The vendor cannot provide evidence of any security policies, procedures, or past audits

Answer

The vendor references NIST SP 800-53 controls

Answer

The vendor uses a third-party data center

Answer

The vendor has fewer than 50 employees

Question 3

Which of the following is a key component of a Supply Chain Risk Management (SCRM) plan?

Accepted Answer

Identification of critical suppliers, risk assessment criteria, mitigation strategies, and incident response procedures

Answer

A list of preferred vendors sorted by lowest price

Answer

A single point of contact for all procurement activities

Answer

An annual review of vendor marketing materials

Question 4

What is the purpose of maintaining an approved vendor list (AVL) in an industrial security program?

Accepted Answer

To restrict procurement to suppliers who have been vetted and approved based on security and quality criteria

Answer

To publicly disclose all vendors for transparency

Answer

To track vendor invoice payment status

Answer

To identify vendors eligible for volume discounts

Question 5

When a vendor's security certification (e.g., ISO 27001) expires without renewal, what should an industrial security professional do?

Accepted Answer

Initiate a re-evaluation of the vendor's security posture and request remediation or updated certification

Answer

Automatically assume the vendor remains compliant based on past performance

Answer

Continue using the vendor with no action until the next scheduled review

Answer

Immediately terminate the vendor relationship

Question 6

Which of the following BEST describes a 'sole-source supplier' risk in supply chain security?

Accepted Answer

The risk that a single supplier, with no viable alternatives, becomes a critical point of failure for the organization

Answer

A risk arising from using only domestic suppliers

Answer

The risk of a supplier offering services to competitors

Answer

A risk specific to suppliers of personal protective equipment

Question 7

Which of the following MOST accurately describes the concept of 'supply chain resilience' for an industrial security professional?

Accepted Answer

The capacity of the supply chain to anticipate, withstand, adapt to, and recover from disruptions while maintaining continuous operations

Answer

The ability to negotiate contracts quickly

Answer

Stockpiling large quantities of all supplies on-site

Answer

Eliminating all foreign-manufactured components from the supply chain