Describe How to Create and Leverage a SBOM (Software Bill of Materials) in Cybersecurity Defenses. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the best practice for updating an SBOM when a software component changes?

   • AManually edit the existing SBOM file to add the new component
   • BWait until the next major release to update the SBOM
   • CRegenerate the SBOM as part of the build process for the new version
   • DDelete the old SBOM and create a new one from scratch without automation
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst receives an SBOM for a web application and needs to identify which components are affected by a newly disclosed critical vulnerability in a specific open-source library. The SBOM is in SPDX format. What is the most effective first step for the analyst to take?

   • ARun a network scan of the application to identify the library in use.
   • BReview the application's source code to find the library import statement.
   • CContact the library vendor to request a list of affected applications.
   • DSearch the SBOM for the library name and version, then cross-reference it with the vulnerability advisory.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is a key feature of the CycloneDX SBOM standard?

   • AIt is a proprietary format used only by Microsoft products
   • BIt is primarily used for tracking software licenses and copyrights
   • CIt is a binary format that is not human-readable
   • DIt is designed specifically for security-focused use cases, including vulnerability and component risk analysis
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company has a policy that requires all production applications to have an up-to-date SBOM. The company uses a centralized artifact repository. A security auditor finds that some applications have SBOMs that are over a year old. What is the most effective process improvement to ensure SBOMs are always current?

   • AManually update the SBOMs once a year during the annual security review.
   • BRemove the SBOM requirement for applications that are not frequently updated.
   • CUse a runtime scanner to generate SBOMs on-demand whenever an audit is scheduled.
   • DRequire that an SBOM be generated and stored in the artifact repository as a mandatory step in the CI/CD pipeline for every build.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of a Software Bill of Materials (SBOM) in cybersecurity defense?

   • ATo provide a legal document proving software ownership and licensing
   • BTo provide a detailed inventory of all software components and dependencies used in a product
   • CTo automatically patch known vulnerabilities in software components
   • DTo replace the need for vulnerability scanning in the software development lifecycle
   Reveal Solution Discussion Select an answer first