Supply Chain Attacks GCIL Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A company is reviewing its supply chain security posture. They have identified that a critical vendor uses a third-party code repository to host its software. The company is concerned about the risk of a compromised update from this repository. Which control would be most effective in mitigating this specific risk?

   • AMonitoring the vendor's repository for suspicious activity
   • BImplementing a web application firewall (WAF) in front of the repository
   • CRequiring the vendor to sign all releases with a code-signing certificate
   • DConducting regular penetration tests on the company's own network
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company is assessing the risk of a supply chain attack on its critical infrastructure. They have identified a vendor that provides a component used in their industrial control systems. The vendor has a history of security incidents. The company is considering whether to continue using this vendor. What is the most important factor to consider in this decision?

   • AThe vendor's geographic location
   • BThe cost of the vendor's services
   • CThe availability of alternative vendors that can provide the same component
   • DThe vendor's marketing materials
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A manufacturing company learns that a firmware update for its industrial controllers, supplied by a trusted automation vendor, contains a backdoor that allows remote attackers to alter production line settings. The company's leadership asks the incident response team to prioritize the response. Which consideration should be the team's primary focus when assessing the impact of this supply chain compromise?

   • AThe financial cost of replacing all controllers, because that is the only way to eliminate the backdoor.
   • BThe confidentiality of the firmware update files, because the backdoor might have been copied by competitors.
   • CThe integrity and availability of the industrial control systems, because altered settings could cause physical damage or unsafe operation.
   • DThe legal liability of the automation vendor, because the company should immediately pursue litigation.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which of the following is a key component of vendor risk management to mitigate supply chain attacks?

   • ARequiring all employees to use multi-factor authentication.
   • BConducting security assessments of third-party vendors before and during the engagement.
   • CPerforming regular backups of critical data.
   • DBlocking all inbound traffic from the internet to the organization's network.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A financial services firm is reviewing its vendor risk management program after a recent supply chain attack in its industry. The firm wants to implement a proactive control that specifically targets the risk of a compromised software update from a critical vendor. Which control is most directly aligned with this goal?

   • AMaintain an inventory of all vendor software and versions
   • BRequire the vendor to sign all software releases with a code-signing certificate
   • CPurchase cyber insurance to cover losses from supply chain incidents
   • DConduct annual on-site audits of the vendor's facilities
   Reveal Solution Discussion Select an answer first