Explain the Importance of Supply Chain Risk Management (SCRM) in Cybersecurity. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A financial services firm is assessing its vendors. They have identified a vendor that provides critical payment processing services but has had recent security incidents. Another vendor provides non-critical office supplies and has a strong security record. The firm has limited resources for assessments. How should they prioritize?

   • AAssess both vendors equally because all vendors pose the same risk.
   • BFocus on the payment processor due to its criticality and incident history.
   • CDefer assessment of the payment processor until after the office supplies vendor is assessed.
   • DFocus on the office supplies vendor because they have a strong security record.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company's board of directors is reviewing the annual cybersecurity report. The report includes a section on supply chain risks, but the board members are not familiar with technical details. What is the best way to present supply chain risks to the board?

   • AUse technical jargon to demonstrate the complexity of the risks.
   • BFocus on the business impact, such as potential financial loss and operational disruption.
   • CProvide a detailed list of all vulnerabilities found in each vendor.
   • DRecommend immediate termination of all high-risk vendors without further analysis.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company relies on a single supplier for a critical component. The supplier has a strong security program but is located in a country with unstable political conditions. The company's risk team is evaluating the supply chain risk. What is the most significant risk to consider?

   • AThe risk of supply disruption due to geopolitical instability.
   • BThe supplier's security program is strong, so there is no risk.
   • CThe risk of data breach from the supplier's weak security controls.
   • DThe risk of regulatory non-compliance in the supplier's country.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   How can an organization collaborate with partners to enhance the overall security posture?

   • AKeeping all security information confidential from partners
   • BSharing threat intelligence and best practices
   • CRequiring partners to implement the same security controls as the organization
   • DAvoiding communication with partners to reduce complexity
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company uses a third-party logistics provider that manages its warehouse and shipping. The logistics provider uses a subcontracted IT firm to run its inventory system. A vulnerability is found in the IT firm's system. What is this an example of?

   • AA first-party risk
   • BA third-party risk
   • CA second-party risk
   • DA fourth-party risk
   Reveal Solution Discussion Select an answer first