1.11 - Apply Supply Chain Risk Management (SCRM) Concepts CISSP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a supply chain risk associated with acquiring software from a third-party vendor?

   • AThe software may contain counterfeit components that are not genuine
   • BThe software may not have a user-friendly graphical interface
   • CThe software may be available in multiple languages
   • DThe software may require a higher-end computer to run smoothly
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   How does a physically unclonable function (PUF) help prevent counterfeiting?

   • AIt creates a unique fingerprint that is difficult to replicate
   • BIt blocks all network connections to the device
   • CIt requires a password to access the device
   • DIt encrypts the device's serial number
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A financial services firm relies on a cloud provider for critical infrastructure. The firm's compliance team needs assurance that the provider's security controls remain effective over time. The provider has passed an initial third-party audit. What should the firm implement to maintain ongoing assurance?

   • ARequest a copy of the provider's business continuity plan and review it annually.
   • BConduct a one-time review of the provider's security policies and procedures.
   • CRequire the provider to submit to continuous monitoring and periodic third-party assessments.
   • DRely solely on the provider's self-reported compliance status.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company is about to sign a contract with a new IT services provider. The company wants to reduce the risk of the provider failing to meet security expectations. Which of the following should be included in the contract?

   • AA statement of work that describes the project scope
   • BA list of the provider's other clients
   • CMinimum security requirements and service level requirements
   • DA non-disclosure agreement only
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A critical infrastructure organization is procuring a new operational technology (OT) system. The system includes both hardware and software from multiple suppliers. The organization has a limited budget and must balance cost with security. The security team has identified the following risks: counterfeit hardware, malicious software implants, and unpatched third-party components. Which combination of controls would best mitigate these risks while being cost-effective?

   • AConduct a full third-party assessment of every supplier and require a silicon root of trust in all hardware.
   • BUse only one supplier for all hardware and software to simplify management.
   • CRequire SBOMs from software suppliers, use PUFs for hardware authentication, and establish minimum security requirements for all suppliers.
   • DRely on the suppliers' self-assessments and require a certificate of authenticity for all hardware.
   Reveal Solution Discussion Select an answer first