1.11 - Apply Supply Chain Risk Management (SCRM) Concepts CISSP Practice Questions (Page 6)

Questions 26–29

1. 26expert · hard

   A security architect is designing a system that requires both hardware-level assurance of the boot process and protection against counterfeit components. The architect has a limited budget and must choose between a silicon root of trust and physically unclonable functions (PUFs). Which choice best meets both requirements?

   • AUse only PUFs, as they also provide boot integrity.
   • BUse only a silicon root of trust, as it also provides anti-counterfeiting.
   • CUse a silicon root of trust for boot integrity and PUFs for component authentication.
   • DUse neither, as the requirements are not important.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary role of service level requirements (SLRs) in supply chain risk management?

   • ATo specify the exact hardware that the supplier must use
   • BTo set the price of the service
   • CTo transfer all security risks to the supplier
   • DTo define the expected performance and availability of the supplier's service
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A hardware vendor wants to ensure that its products are not counterfeited. The vendor is considering using PUFs, but is concerned about the cost of implementing them. The vendor also wants to ensure that its suppliers meet minimum security requirements. What is the most cost-effective approach?

   • AUse a simple serial number for all products.
   • BImplement PUFs in all products, regardless of value.
   • CRely on supplier assessments and do not implement PUFs.
   • DImplement PUFs in high-value products and establish minimum security requirements for all suppliers.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A government agency is procuring network equipment from a foreign supplier. The agency is concerned about the risk of malicious implants and espionage. The supplier has agreed to a third-party assessment, but the agency wants additional assurance. What should the agency do?

   • ARequire a silicon root of trust in the equipment and conduct independent verification of the supply chain.
   • BProhibit the use of any foreign suppliers.
   • CAccept the risk because the supplier is reputable.
   • DRely solely on the third-party assessment, as it is sufficient.
   Reveal Solution Discussion Select an answer first