Examkin

Question

Difficulty: MediumThird-Party Risk Management and Supply Chain Oversight

An organization is purchasing enterprise network hardware to deploy in a high-security facility. To mitigate the threat of hardware supply chain tampering and counterfeit component insertion during transit from the vendor, which of the following operational controls should the organization mandate upon equipment delivery?

  1. Verifying tamper-evident physical packaging seals and performing cryptographic attestation of embedded hardware componentsAnswer
  2. B
    Signing a Service Level Agreement (SLA) with the logistics provider specifying a 99.99% shipping uptime guarantee
  3. C
    Deploying an inline web application firewall (WAF) to inspect network traffic prior to unboxing the hardware
  4. D
    Executing an Interconnection Security Agreement (ISA) with the hardware vendor prior to shipment

Answer

Verifying tamper-evident physical packaging seals and performing cryptographic attestation of embedded hardware components.
Verifying tamper-evident packaging seals and conducting cryptographic hardware attestation directly addresses supply chain risks by ensuring devices were not intercepted, opened, or modified in transit.

Step-by-Step Solution

1
Analyze the threat scenario presented in the stem.
The identified risk is physical tampering, unauthorized hardware modifications, or counterfeit component swapping during transit across the third-party supply chain.
Supply chain oversight requires controls capable of validating physical and hardware-level integrity upon receipt.
2
Evaluate the proposed operational security controls.
Physical inspection of tamper-evident seals combined with cryptographic component attestation (such as comparing boot measurements against trusted vendor hashes) directly validates that hardware has not been altered.
Contractual agreements (SLAs, ISAs) and network-layer controls (WAFs) do not inspect or verify physical device authenticity.

Key Concept

Hardware Supply Chain Verification and Anti-Tampering Controls
Rate this question

Topics

Third-Party Risk Management and Supply Chain Oversight

More questions from this topic