Explain the Importance of Supply Chain Risk Management (SCRM) in Cybersecurity. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is a key best practice in vendor management to reduce supply chain cybersecurity risk?

   • ASelecting vendors solely based on the lowest cost
   • BSharing all internal security documentation with vendors
   • CAvoiding all third-party vendors to eliminate risk
   • DConducting regular security reviews of vendors
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company has two vendors: Vendor A provides a critical service but has a high likelihood of a security incident. Vendor B provides a non-critical service but has a low likelihood of an incident. The company has limited budget for risk mitigation. What is the most appropriate approach?

   • AInvest in Vendor A to reduce its likelihood, and accept the risk for Vendor B.
   • BInvest all mitigation budget in Vendor A because it is critical.
   • CInvest equally in both vendors to be fair.
   • DTerminate the relationship with Vendor A and use Vendor B as a replacement.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which international standard focuses on security management systems for the supply chain?

   • AISO 22301
   • BISO 28000
   • CISO 9001
   • DISO 27001
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company has identified a critical vulnerability in a third-party component. The vulnerability is not yet publicly disclosed, and the vendor is working on a patch. The company's security team wants to inform stakeholders but is concerned about leaking sensitive information. What is the best approach?

   • AInform all stakeholders immediately with full technical details.
   • BWait until the patch is available before informing anyone.
   • CInform only senior management and the vendor, and keep details confidential.
   • DInform all employees to raise awareness.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company is conducting a risk assessment of its suppliers. They have identified that a supplier has a high likelihood of a data breach due to weak security controls, but the supplier only provides non-sensitive office equipment. How should the company prioritize this risk?

   • AHigh priority because the likelihood is high.
   • BNo priority because the supplier is not critical.
   • CLow priority because the impact is low.
   • DMedium priority because the likelihood and impact are balanced.
   Reveal Solution Discussion Select an answer first