Supply Chain Attacks GCIL Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A hospital's electronic health record (EHR) system is provided by a vendor that uses a third-party cloud infrastructure. The cloud provider suffers a ransomware attack that encrypts the vendor's systems, making the EHR unavailable for several days. Which impact is most directly associated with this supply chain incident?

   • ANon-repudiation of clinical actions, because the audit logs are unavailable.
   • BIntegrity of patient data, because the encryption may have altered records.
   • CAvailability of patient data, because clinicians cannot access records to provide care.
   • DConfidentiality of patient data, because the ransomware may have exfiltrated records.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A large enterprise is updating its incident response plan to include supply chain attacks. They have a complex environment with multiple critical vendors. The security team is debating whether to include a tabletop exercise that simulates a compromised software update from a key vendor. The CISO is concerned about the time and resources required. What is the most compelling reason to conduct the tabletop exercise?

   • AIt will eliminate the need for other security controls
   • BIt will guarantee that the organization's systems are protected from future attacks
   • CIt will test the organization's ability to coordinate with the vendor and external parties during a crisis
   • DIt will identify the specific attacker responsible for the compromise
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company's incident response team is updating its playbook to include supply chain attack scenarios. The team wants to ensure that the playbook addresses coordination with external parties. Which element should be included in the playbook?

   • AA plan to isolate the company's network from all external communications for the duration of the incident.
   • BA requirement to publicly disclose the incident on social media within one hour.
   • CA list of key external contacts, such as vendors, law enforcement, and information-sharing organizations, with defined communication protocols.
   • DA procedure for immediately terminating all contracts with vendors involved in the incident.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A regional hospital uses a third-party patient-billing platform. During a routine vendor audit, the hospital discovers that the vendor's software update server was compromised and is distributing a modified client that exfiltrates patient records. The hospital's security team wants to reduce the risk of this type of incident recurring. Which control is most directly aimed at preventing the distribution of tampered software updates?

   • ARequire the vendor to sign all software updates with a code-signing certificate and verify the signature before deployment.
   • BSegment the hospital's network so the billing platform cannot reach the internet.
   • CConduct annual on-site audits of the vendor's physical data center.
   • DIncrease the frequency of full-disk backups of the billing platform servers.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company's supply chain attack results in the theft of customer credit card data from a third-party payment processor. Which impact is most directly associated with this incident?

   • ANon-repudiation of payment transactions, because the attacker could have altered transaction logs.
   • BAvailability of the payment processing system, because it was taken offline.
   • CIntegrity of customer payment data, because the data was modified.
   • DConfidentiality of customer payment data, because the data was stolen.
   Reveal Solution Discussion Select an answer first