Examkin

Soru

Zorluk: OrtaThird-Party Risk Management and Supply Chain Oversight

An organization is purchasing enterprise network hardware to deploy in a high-security facility. To mitigate the threat of hardware supply chain tampering and counterfeit component insertion during transit from the vendor, which of the following operational controls should the organization mandate upon equipment delivery?

  1. Verifying tamper-evident physical packaging seals and performing cryptographic attestation of embedded hardware componentsCevap
  2. B
    Signing a Service Level Agreement (SLA) with the logistics provider specifying a 99.99% shipping uptime guarantee
  3. C
    Deploying an inline web application firewall (WAF) to inspect network traffic prior to unboxing the hardware
  4. D
    Executing an Interconnection Security Agreement (ISA) with the hardware vendor prior to shipment

Cevap

Verifying tamper-evident physical packaging seals and performing cryptographic attestation of embedded hardware components.
Verifying tamper-evident packaging seals and conducting cryptographic hardware attestation directly addresses supply chain risks by ensuring devices were not intercepted, opened, or modified in transit.

Adım Adım Çözüm

1
Analyze the threat scenario presented in the stem.
The identified risk is physical tampering, unauthorized hardware modifications, or counterfeit component swapping during transit across the third-party supply chain.
Supply chain oversight requires controls capable of validating physical and hardware-level integrity upon receipt.
2
Evaluate the proposed operational security controls.
Physical inspection of tamper-evident seals combined with cryptographic component attestation (such as comparing boot measurements against trusted vendor hashes) directly validates that hardware has not been altered.
Contractual agreements (SLAs, ISAs) and network-layer controls (WAFs) do not inspect or verify physical device authenticity.

Anahtar Kavram

Hardware Supply Chain Verification and Anti-Tampering Controls
Bu soruyu puanla

Konular

Third-Party Risk Management and Supply Chain Oversight

Bu konudan daha fazla soru