Supply Chain Attacks GCIL Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company's security team is evaluating its supply chain risk. They have a list of all their third-party vendors and partners. Which factor most significantly increases the company's risk of a supply chain attack?

   • AA vendor that provides a low-cost service
   • BA vendor with broad access to the company's internal systems
   • CA vendor that has been in business for a long time
   • DA vendor that is located in a different country
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A logistics company uses a third-party logistics management system that is hosted by the vendor. The vendor's system is compromised, and the attacker uses the vendor's legitimate access to the company's shipment database to steal customer addresses. Which supply chain attack vector best describes this incident?

   • AHardware implant, because the attacker physically inserted a device into the vendor's server.
   • BCompromised software update, because the vendor's system was updated with malicious code.
   • CThird-party service vulnerability, because the attacker exploited a weakness in the vendor's hosted service to access the company's data.
   • DInsider threat, because the vendor's employees intentionally leaked the data.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company uses a third-party SaaS platform for its customer relationship management (CRM). The SaaS provider suffers a breach that exposes the company's customer data. The company's security team wants to implement a control to reduce the risk of data exposure from this type of third-party service vulnerability. Which control is most effective?

   • AImplement multi-factor authentication (MFA) for all users of the SaaS platform
   • BUse a VPN when accessing the SaaS platform
   • CRegularly back up all data stored in the SaaS platform
   • DConduct a thorough security assessment of the SaaS provider before signing the contract
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company is considering implementing a software bill of materials (SBOM) program to improve its supply chain security. The security team is evaluating the potential benefits. Which benefit is most directly associated with having a comprehensive SBOM?

   • AIt automatically patches all vulnerable software components
   • BIt prevents all supply chain attacks from occurring
   • CIt eliminates the need for vendor risk assessments
   • DIt enables rapid identification of affected systems when a vulnerability is disclosed in a specific component
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Why do supply chain attacks target the trust relationships between organizations and their suppliers?

   • ABecause suppliers typically have weaker security controls than the target organization.
   • BBecause suppliers are required by law to share all security incident details with their customers.
   • CBecause suppliers are always located in foreign countries with different legal systems.
   • DBecause the trust relationship gives the supplier a level of access or credibility that the attacker can exploit.
   Reveal Solution Discussion Select an answer first