Explain the Importance of Supply Chain Risk Management (SCRM) in Cybersecurity. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In a supply chain risk assessment, what is the primary purpose of prioritizing risks?

   • ATo eliminate all risks from the supply chain
   • BTo allocate limited resources to the most significant risks
   • CTo ensure compliance with all relevant regulations
   • DTo identify all potential suppliers in the market
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which NIST publication provides specific guidance for managing supply chain risks in cybersecurity?

   • ANIST SP 800-161
   • BNIST SP 800-30
   • CNIST SP 800-171
   • DNIST SP 800-53
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is onboarding a new vendor that will have access to its internal network. The vendor's security practices are not well-documented. What is the most effective control to mitigate this risk?

   • ADeny access until the vendor provides a security certification.
   • BGrant access and monitor the vendor's activities.
   • CConduct a security assessment of the vendor before granting access.
   • DRequire the vendor to sign a non-disclosure agreement.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is a security control that can be used to mitigate supply chain risks?

   • ARequiring vendors to adhere to security requirements through contractual clauses
   • BImplementing multi-factor authentication for all internal users
   • CDisabling all external network connections to the organization
   • DEncrypting all data at rest in the organization's data center
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company is negotiating a contract with a cloud service provider. The company's security team wants to ensure the provider is contractually obligated to report security incidents and allow security assessments. What should the security team include in the contract?

   • AA non-disclosure agreement (NDA) to protect confidential data.
   • BA service-level agreement (SLA) for uptime only.
   • CA data processing agreement (DPA) that defines data handling roles.
   • DA right-to-audit clause and incident notification requirements.
   Reveal Solution Discussion Select an answer first