ISP Supply Chain Security & Vendor Management 3

Question 1

Which of the following BEST mitigates the risk of a software supply chain attack, such as the SolarWinds-type attack?

Accepted Answer

Implementing software bill of materials (SBOM) reviews and code integrity verification before deployment

Answer

An SBOM provides a detailed inventory of software components, allowing organizations to identify vulnerable or compromised components, while code integrity verification (e.g., hash checking) detects unauthorized modifications.

Question 2

An industrial security professional is reviewing a vendor's security self-assessment. Which of the following responses would be the GREATEST red flag?

Accepted Answer

The vendor cannot provide evidence of any security policies, procedures, or past audits

Answer

The inability to provide documented security policies, procedures, or audit history suggests the vendor has no established security program, representing a significant risk.

Question 3

Which of the following is a key component of a Supply Chain Risk Management (SCRM) plan?

Accepted Answer

Identification of critical suppliers, risk assessment criteria, mitigation strategies, and incident response procedures

Answer

A comprehensive SCRM plan must identify critical suppliers, define how risks are assessed, specify mitigation strategies, and establish how supply chain incidents will be handled.

Question 4

What is the purpose of maintaining an approved vendor list (AVL) in an industrial security program?

Accepted Answer

To restrict procurement to suppliers who have been vetted and approved based on security and quality criteria

Answer

An AVL limits procurement to pre-vetted suppliers, reducing the risk of introducing unvetted or compromised components into the supply chain.

Question 5

When a vendor's security certification (e.g., ISO 27001) expires without renewal, what should an industrial security professional do?

Accepted Answer

Initiate a re-evaluation of the vendor's security posture and request remediation or updated certification

Answer

An expired certification means the vendor's controls have not been independently verified recently; re-evaluation ensures the vendor still meets required security standards before continuing the relationship.

(ISP) Industrial Security Professional Certification Practice Test

(ISP) Industrial Security Professional Certification Practice Test

ISP Supply Chain Security & Vendor Management 3