Supply Chain Attacks GCIL Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A software development company uses a build server that automatically pulls open-source libraries from a public repository. The security team wants to detect if a library has been tampered with before it is integrated into a product. Which control is most effective for this purpose?

   • AVerify the cryptographic hash of each downloaded library against the hash published by the library maintainer.
   • BRequire developers to manually review the source code of every library before use.
   • CIncrease the build server's disk space to store multiple versions of each library.
   • DUse a firewall to block all traffic from the build server to the public repository.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A government agency discovers that a software library used by its internal web application was tampered with at the open-source repository level. The agency's incident response plan does not currently address supply chain incidents. Which action should the incident response team take first to improve coordination with external parties?

   • AImmediately disconnect the agency's entire network from the internet to contain the incident.
   • BContact the agency's legal department to prepare a lawsuit against the open-source maintainers.
   • CDelete all copies of the affected library from all systems and rebuild from memory.
   • DIdentify and document the external parties involved, including the repository maintainers, the package registry, and any downstream consumers.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A large enterprise has a mature incident response program, but its supply chain incident response plan has not been tested. The enterprise relies on a critical software vendor for its ERP system. During a tabletop exercise, the team discovers that the vendor's update server was compromised and malicious updates were deployed to the enterprise's ERP environment. The team must decide the first response action. The enterprise has a regulatory requirement to report significant incidents to a national authority within 72 hours. Which action should the team take first?

   • AActivate the incident response plan and coordinate with the vendor to confirm the scope of the compromise before taking containment actions.
   • BContact legal counsel to prepare for potential lawsuits against the vendor.
   • CReport the incident to the national authority immediately, before any internal investigation.
   • DImmediately disconnect the ERP system from the network to prevent further spread.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company's incident response team is updating its playbook. They want to add a section specifically for handling a supply chain attack where a critical software vendor is compromised. Which element is most important to include in this new section?

   • AA detailed procedure for rebuilding all servers from scratch
   • BA pre-defined communication plan for coordinating with the affected vendor and relevant authorities
   • CA list of internal IT staff members who are on call for after-hours support
   • DA template for notifying customers about the incident
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is the defining characteristic of a supply chain attack?

   • AThe attacker uses social engineering to trick an employee into revealing their password.
   • BThe attacker exploits a vulnerability in the organization's own web application.
   • CThe attacker compromises a trusted supplier or partner to gain access to the organization's systems or data.
   • DThe attacker directly targets an organization's internal network using stolen credentials.
   Reveal Solution Discussion Select an answer first