Explain the Importance of Supply Chain Risk Management (SCRM) in Cybersecurity. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary focus of Supply Chain Risk Management (SCRM) in the context of cybersecurity?

   • AEnsuring that all internal software development follows secure coding practices
   • BManaging risks related to the physical security of an organization's facilities
   • CManaging risks associated with the acquisition and use of products and services from external suppliers
   • DEnsuring compliance with data protection regulations such as GDPR
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a common supply chain threat that can compromise the integrity of software?

   • AA malicious actor injecting backdoor code into a software update distributed by a vendor
   • BAn employee accidentally deleting critical files from a file server
   • CA distributed denial-of-service (DDoS) attack targeting the organization's website
   • DA phishing email sent to employees to steal their credentials
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company's cybersecurity team has identified a critical vulnerability in a third-party component used in their product. The team wants to ensure this risk is addressed at the organizational level. What is the most effective way to integrate this supply chain risk into the broader cybersecurity program?

   • ANotify the vendor and wait for them to release a patch.
   • BDocument the risk in the organizational risk register and escalate to senior management.
   • CHave the cybersecurity team fix the vulnerability without involving other departments.
   • DDiscontinue use of the component immediately without assessing impact.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company has discovered that a key supplier has suffered a ransomware attack that may affect the delivery of critical components. The company's risk team needs to inform stakeholders about the potential impact. What is the most important information to include in the communication?

   • AThe potential impact on operations, timeline for recovery, and mitigation steps.
   • BThe supplier's financial history and credit rating.
   • CThe technical details of the ransomware variant used in the attack.
   • DA list of all other suppliers that could replace this one.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company is considering using a new cloud service provider. The provider offers strong security features, but the company's data residency requirements mandate that data must remain within a specific country. The provider has a data center in that country. What is the most important contractual control to include?

   • AA clause that the provider will notify the company of any security incidents within 24 hours.
   • BA clause specifying that data will be stored and processed only in the designated country.
   • CA clause allowing the provider to use subcontractors for data processing.
   • DA clause requiring the provider to use encryption for data at rest and in transit.
   Reveal Solution Discussion Select an answer first