Examkin

Question

Difficulty: MediumThird-Party Risk Management and Supply Chain Oversight

An enterprise organization is enhancing its vendor onboarding process for commercial off-the-shelf (COTS) software applications. To evaluate software supply chain risks and ensure the integrity of vendor-supplied code before deployment, which TWO of the following controls or artifacts should the security team require from software vendors? (Select TWO)

  1. A comprehensive Software Bill of Materials (SBOM) listing all third-party components and dependenciesAnswer
  2. Cryptographic digital signatures and code-signing attestations for all software deliverablesAnswer
  3. C
    A Non-Disclosure Agreement (NDA) guaranteeing operational uptime targets during maintenance windows
  4. D
    Implementation of an inline Web Application Firewall (WAF) inside the vendor's local development subnet
  5. E
    Annual physical security facility access logs for the vendor's remote software development staff

Answer

The correct requirements are providing a Software Bill of Materials (SBOM) detailing third-party components and enforcing cryptographic code signing with digital signatures to verify software integrity and origin.
Requiring a Software Bill of Materials (SBOM) ensures complete transparency into third-party code libraries and upstream dependencies, allowing organizations to track known vulnerabilities (CVEs). Requiring code signing and cryptographic digital signatures validates the software's authenticity and guarantees that the application code has not been altered or tampered with by unauthorized third parties.

Step-by-Step Solution

1
Analyze the scenario objective.
The goal is to evaluate third-party software supply chain risk and ensure binary integrity before deployment.
Supply chain oversight requires verification of upstream software dependencies and proof that code has not been tampered with.
2
Evaluate artifacts and controls that provide software supply chain assurance.
A Software Bill of Materials (SBOM) provides complete transparency into nested dependencies, and code signing cryptographically verifies code origin and uncompromised integrity.
These two items directly mitigate supply chain vulnerabilities and tampering risks.
3
Differentiate improper or misclassified administrative and technical controls.
Confusing NDAs with SLAs, or requiring physical logs/internal developer WAFs, fails to validate the security and authenticity of distributed software packages.
General administrative agreements and unrelated operational controls do not satisfy supply chain software verification requirements.

Key Concept

Software Supply Chain Oversight and Integrity Verification
Rate this question

Topics

Third-Party Risk Management and Supply Chain Oversight

More questions from this topic