Explain the Importance of Supply Chain Risk Management (SCRM) in Cybersecurity. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company is developing a new product that relies on open-source software components. The company's legal team is concerned about licensing, and the security team is concerned about vulnerabilities. What is the most comprehensive approach to manage this supply chain risk?

   • AAvoid using open-source software altogether to eliminate the risk.
   • BCreate a software bill of materials (SBOM) and use it to track both licensing and security issues.
   • CRely on the open-source community to fix vulnerabilities without internal tracking.
   • DHave the legal team review all licenses and the security team scan for vulnerabilities separately.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is a common methodology used to assess supply chain cybersecurity risk?

   • APerforming a penetration test on the organization's own network
   • BConducting a vendor security assessment using a standardized questionnaire
   • CMonitoring social media for negative mentions of the organization
   • DReviewing the organization's financial audit reports
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is within the scope of Supply Chain Risk Management (SCRM)?

   • ADeveloping an incident response plan for internal security breaches
   • BConducting background checks on new employees
   • CAssessing the cybersecurity posture of a third-party vendor that provides cloud hosting services
   • DConfiguring firewall rules for the organization's internal network
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company's procurement team is evaluating a new software vendor that will have access to customer data. The vendor's security questionnaire indicates they outsource their data processing to a subcontractor. The company's risk team wants to ensure the entire chain is assessed. What should the company do first?

   • ARequest details about the subcontractor and include them in the risk assessment.
   • BImmediately terminate the vendor relationship due to subcontractor use.
   • CRequire the vendor to eliminate all subcontractors before proceeding.
   • DAccept the vendor's questionnaire as sufficient evidence of security.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is defining the scope of its supply chain risk management program. The CISO wants to ensure that all relevant parties are included. Which of the following should be explicitly included in the scope?

   • AOnly direct suppliers that provide hardware and software.
   • BAll third-party vendors, subcontractors, and service providers that have access to company data or systems.
   • COnly vendors that handle customer data.
   • DOnly vendors that are located in the same country as the company.
   Reveal Solution Discussion Select an answer first