Supply Chain Attacks GCIL Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company is implementing a vendor risk management program. They have a large number of vendors, but limited resources for assessments. Which approach is most effective for prioritizing which vendors to assess first?

   • APrioritize vendors based on the sensitivity of the data they can access and the criticality of their services
   • BAssess only vendors that are located in the same country
   • CAssess vendors in alphabetical order to ensure fairness
   • DAssess vendors that offer the lowest cost services
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company's risk assessment identifies that a critical supplier has weak security controls. The company relies on this supplier for a key component in its product. What is the most appropriate risk treatment strategy for this scenario?

   • AMitigate the risk by requiring the supplier to implement specific security controls
   • BAvoid the risk by immediately terminating the relationship with the supplier
   • CTransfer the risk by purchasing cyber insurance
   • DAccept the risk because the supplier is critical and cannot be replaced
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A hospital uses a medical device vendor that provides software updates for infusion pumps. The vendor's update server is compromised, and a malicious update is deployed to the pumps. The hospital's security team must assess the impact. The pumps are connected to the hospital network but are not directly connected to the internet. Which impact is most critical to consider?

   • AThe non-repudiation of the update logs, because the logs might be forged.
   • BThe integrity of the infusion pump software, because a malicious update could alter drug dosage calculations and harm patients.
   • CThe confidentiality of the patient data stored on the pumps.
   • DThe availability of the pumps, because the update might cause them to crash.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   How does code signing help mitigate supply chain attacks?

   • AIt prevents all malware from being installed on a system.
   • BIt encrypts the software so that only authorized users can install it.
   • CIt verifies the authenticity and integrity of software by confirming the digital signature is valid and the code has not been tampered with.
   • DIt automatically updates software to the latest version.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is an important consideration when coordinating with external parties during a supply chain incident?

   • ASharing all sensitive information publicly to ensure transparency.
   • BEstablishing clear communication channels and information-sharing agreements with vendors and partners before an incident occurs.
   • CWaiting for law enforcement to take over all aspects of the investigation before taking any action.
   • DAvoiding contact with the affected vendor to prevent panic.
   Reveal Solution Discussion Select an answer first