Supply Chain Attacks GCIL Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An organization is developing a response plan for a supply chain attack. They want to ensure they can effectively coordinate with external parties. Which element is most important to include in the plan?

   • AA list of internal employees who are trained in incident response
   • BA policy for automatically terminating all vendor contracts
   • CA detailed technical guide for reverse engineering malware
   • DA list of pre-approved legal counsel and public relations firms
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company is evaluating the impact of a potential supply chain attack. They have identified that a compromised software update could affect their production systems. The company is considering implementing a control to reduce the impact. Which control is most effective in reducing the impact of a compromised update?

   • APurchasing additional network bandwidth
   • BImplementing a staging environment to test updates before deployment
   • CImplementing a more complex password policy
   • DIncreasing the frequency of data backups
   Reveal Solution Discussion Select an answer first
4. 8application · easy

   A small business uses a popular accounting software package. The software vendor's update server is compromised, and a malicious update is pushed to all customers. The business installs the update and later discovers that their financial data has been exfiltrated. Which statement best describes why this is considered a supply chain attack?

   • AThe attack exploited the trusted relationship between the business and its software vendor
   • BThe attack was a form of social engineering targeting the business's employees
   • CThe attack targeted the business's internal network directly
   • DThe attack was a distributed denial-of-service (DDoS) attack on the business's systems
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is an example of continuous monitoring to detect supply chain attacks?

   • AReviewing vendor security reports and monitoring vendor-issued software for anomalies on an ongoing basis.
   • BConducting an annual security audit of the organization's own network.
   • CPerforming a one-time penetration test of the organization's web application.
   • DRequiring vendors to sign a non-disclosure agreement.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is a common vector for a supply chain attack?

   • ACompromised software updates distributed by a vendor.
   • BPhishing emails sent directly to employees of the target organization.
   • CBrute-force attacks against the organization's VPN gateway.
   • DSQL injection against the organization's public website.
   Reveal Solution Discussion Select an answer first