Examkin

Question

Difficulty: HardThird-Party Risk Management and Supply Chain Oversight

An organization's DevSecOps team is implementing a supply chain security framework to validate third-party software packages and open-source dependencies incorporated into its CI/CD pipeline. The security posture mandates continuous visibility into nested software components and verification that compiled binaries match their declared source code repositories. Which of the following solutions should the security team implement to achieve this objective?

  1. Incorporate a Software Bill of Materials (SBOM) validation process coupled with cryptographically signed build provenance attestations.Answer
  2. B
    Execute an Interconnection Security Agreement (ISA) specifying technical control requirements with external code repository hosts.
  3. C
    Require third-party software vendors to submit annual SOC 2 Type I reports covering physical host environment boundaries.
  4. D
    Implement an inline web application firewall (WAF) to inspect incoming third-party software library downloads.

Answer

Incorporate a Software Bill of Materials (SBOM) validation process coupled with cryptographically signed build provenance attestations.
The solution combining a Software Bill of Materials (SBOM) with cryptographically signed build provenance attestations directly addresses software supply chain security. An SBOM details all third-party and open-source libraries (nested dependencies), enabling continuous vulnerability tracking. Signed build provenance attestations verify the integrity of the compilation process, confirming that the binary artifact was produced by an authorized build pipeline from the audited source repository without unauthorized code injection.

Step-by-Step Solution

1
Identify the core requirements from the scenario.
The organization requires full visibility into nested software dependencies and verification that compiled software binaries match their declared source repositories.
Supply chain security requires both component transparency and build integrity controls.
2
Evaluate the mechanism for component transparency.
A Software Bill of Materials (SBOM) lists all nested dependencies, libraries, and modules within a software package.
An SBOM fulfills the visibility requirement across third-party software components.
3
Evaluate the mechanism for binary integrity and source code provenance.
Cryptographically signed build provenance attestations certify the exact source, build pipeline, and cryptographic hash of compiled software binaries.
Attestations prevent supply chain attacks where compiled artifacts are tampered with after source code inspection.

Key Concept

Third-Party Supply Chain Security and Software Provenance Verification
Estimated Time:1m 30s
Rate this question

Topics

Third-Party Risk Management and Supply Chain Oversight

More questions from this topic