Describe How to Create and Leverage a SBOM (Software Bill of Materials) in Cybersecurity Defenses. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company releases a mobile application that includes a third-party SDK. Six months later, a critical vulnerability is disclosed in that SDK. The security team wants to determine if the released application is affected. The SBOM was generated at build time and has not been updated since. What is the most significant limitation of using this SBOM?

   • AThe SBOM is only useful for open-source components, not commercial SDKs.
   • BThe SBOM cannot be used to identify vulnerabilities because it only lists licenses.
   • CThe SBOM may not reflect the exact version of the SDK if the build process has changed since the SBOM was generated.
   • DThe SBOM format does not support version information for third-party SDKs.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A DevOps team wants to enforce a policy that blocks a build if any component in the SBOM has a critical vulnerability. The team uses a CI pipeline and generates a CycloneDX SBOM for each build. However, some builds are failing because the vulnerability scanner is flagging vulnerabilities in test dependencies that are not included in the final artifact. What is the most effective way to address this issue?

   • AChange the SBOM format to SPDX to avoid the vulnerability data.
   • BDisable the vulnerability scanner for all builds to avoid build failures.
   • CConfigure the SBOM generation to exclude test dependencies and only include runtime dependencies.
   • DManually approve each build that fails the vulnerability scan.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is a key advantage of automated SBOM generation over manual compilation?

   • AIt eliminates the need for any human oversight in the software development process
   • BIt guarantees the software is free of all known vulnerabilities
   • CIt ensures the SBOM is always up-to-date with the exact components in each build
   • DIt automatically patches vulnerabilities in the components
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An organization is required to provide SBOMs to a regulatory body. The SBOMs must be accurate and up-to-date at the time of submission. The organization has a mix of legacy applications that are no longer built and modern applications that are built continuously. What is the most appropriate strategy for the legacy applications?

   • AGenerate a fresh SBOM for each legacy application by analyzing the deployed artifacts directly.
   • BRecreate the original build environment for each legacy application to regenerate the SBOM.
   • CExclude legacy applications from the SBOM submission because they are no longer built.
   • DSubmit the last known SBOM for each legacy application, even if it is outdated.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security architect is explaining the value of SBOMs to executive leadership. The executives want to understand how SBOMs improve the organization's security posture beyond just listing components. Which benefit should the architect highlight as the primary security advantage?

   • ASBOMs guarantee that all software components are free of vulnerabilities.
   • BSBOMs enable faster and more accurate identification of affected components when a new vulnerability is disclosed.
   • CSBOMs automatically patch vulnerabilities in software components.
   • DSBOMs eliminate the need for penetration testing.
   Reveal Solution Discussion Select an answer first