A large enterprise is evaluating a new software vendor. The vendor has passed a third-party assessment, but the enterprise wants to ensure that the vendor's security posture remains acceptable over the life of the contract. What should the enterprise include in the contract?

A requirement for the vendor to use a specific cloud provider

A clause that allows the enterprise to terminate the contract at any time

A one-time security review before signing

A requirement for periodic third-party assessments and continuous monitoring

A software company is acquiring a code library from a third-party developer. The library is widely used and has a known vulnerability that has not been patched. The company's legal team is concerned about liability, and the security team is concerned about the risk of exploitation. What is the most appropriate action?

Use the library but do not disclose the vulnerability to users.

Require the developer to patch the vulnerability and provide an updated SBOM before integration.

Accept the risk and use the library as-is, as the vulnerability is not critical.

Find a completely new library without any vulnerabilities.

A government agency is procuring hardware for a secure communications system. The agency is concerned about the risk of malicious implants or tampering during the manufacturing process. Which technology provides hardware-level assurance against such tampering?

Network intrusion detection system

Which of the following is an example of a minimum security requirement for a supplier?

The supplier must implement multi-factor authentication for all remote access

The supplier must use a specific brand of firewall

The supplier must provide the lowest possible price

The supplier must have a marketing department

A software development company uses many open-source libraries in its products. The security team wants to quickly identify which libraries are affected when a new vulnerability is disclosed. What should the team implement?

A vulnerability scanner for the production network

A software bill of materials (SBOM) for each product

A data loss prevention (DLP) solution

A network firewall with intrusion prevention

Certified Information Systems Security Professional

Domain 1Objective 11

1.11 - Apply Supply Chain Risk Management (SCRM) Concepts CISSP Practice Questions (Page 4)

Part of the Security and Risk Management domain, which accounts for 16% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 1–2 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

7concepts

16%of the exam

Questions 16–20

16application · medium
A large enterprise is evaluating a new software vendor. The vendor has passed a third-party assessment, but the enterprise wants to ensure that the vendor's security posture remains acceptable over the life of the contract. What should the enterprise include in the contract?
Select an answer first
17expert · hard
A software company is acquiring a code library from a third-party developer. The library is widely used and has a known vulnerability that has not been patched. The company's legal team is concerned about liability, and the security team is concerned about the risk of exploitation. What is the most appropriate action?
Select an answer first
18application · medium
A government agency is procuring hardware for a secure communications system. The agency is concerned about the risk of malicious implants or tampering during the manufacturing process. Which technology provides hardware-level assurance against such tampering?
Select an answer first
19foundation · easy
Which of the following is an example of a minimum security requirement for a supplier?
Select an answer first
20application · medium
A software development company uses many open-source libraries in its products. The security team wants to quickly identify which libraries are affected when a new vulnerability is disclosed. What should the team implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.