Implement Software Supply Chain Risk Management (e.g., International Organization for Standardization (ISO), National Institute of Standards and Technology (NIST)) CSSLP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What should an organization do when a third-party component reaches its end-of-life (EOL) date?

   • ARemove the component from the inventory to avoid compliance issues
   • BContinue using the component as long as no known vulnerabilities exist
   • CPlan to replace the component with a supported alternative or apply compensating controls if replacement is not immediately possible
   • DIgnore the EOL status because the component is still functional
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company has an SBOM for each product, but the SBOMs are generated manually by developers. A recent audit found that the SBOMs are incomplete and inaccurate. What should the company do to improve the accuracy of their SBOMs?

   • AHire a dedicated team to maintain SBOMs.
   • BRequire developers to update the SBOM manually after each change.
   • CUse a spreadsheet to track components.
   • DAutomate SBOM generation as part of the build process.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company has a component with a high-severity vulnerability. The vulnerability is not exploitable in their environment, but the component is used in a product that is sold to customers. The customers may use the product in environments where the vulnerability is exploitable. What should the company do?

   • APatch the vulnerability because customers may be affected.
   • BDo not patch because the vulnerability is not exploitable in the company's environment.
   • CNotify customers of the vulnerability and let them decide.
   • DDocument the vulnerability as not exploitable and accept the risk.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which information should be included in a third-party component inventory to support effective supply chain risk management?

   • AThe names of the developers who wrote the component
   • BOnly the component name and the date it was first used
   • CComponent name, version, license type, and dependency relationships
   • DThe total cost of the component and the purchase order number
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   During component selection for a new application, a developer evaluates a third-party library. Which combination of criteria should be considered to ensure the component is suitable for secure use?

   • APopularity on social media and number of GitHub stars
   • BOnly functionality and performance, since security is handled later during testing
   • CFunctionality, security track record, license compatibility, and provenance
   • DCompatibility with the developer's preferred IDE and coding style
   Reveal Solution Discussion Select an answer first