Describe How to Create and Leverage a SBOM (Software Bill of Materials) in Cybersecurity Defenses. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team needs to choose an SBOM format for a new project. The project requires detailed dependency relationships and the ability to include vulnerability data directly in the SBOM. The team also wants to use a format that is widely supported by commercial tools. Which format should they select?

   • ASPDX
   • BCSV
   • CJSON
   • DCycloneDX
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security team has SBOMs for all applications in production. A new critical vulnerability is disclosed in a widely used logging library. The team must determine which applications are affected and prioritize remediation. The SBOMs are in SPDX format and were generated at the last release. Some applications have not been released for over a year. What is the most significant challenge the team faces?

   • AThe SPDX format does not support version numbers for logging libraries.
   • BThe team must manually review every application's source code to find the logging library.
   • CThe SBOMs may be outdated for applications that have not been rebuilt, so they may not reflect the actual logging library version in production.
   • DThe SBOMs cannot be used to identify vulnerabilities because they are not in CycloneDX format.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   When prioritizing remediation efforts using an SBOM, which factor is most important to consider?

   • AThe severity of the vulnerability and the criticality of the affected component
   • BThe age of the component since its initial release
   • CThe number of lines of code in the component
   • DThe alphabetical order of the component names
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In a DevSecOps pipeline, where should SBOM generation be integrated?

   • AAs a manual step performed by the security team after release
   • BAs a step in the user acceptance testing phase
   • CAs a step in the project management tool
   • DAs an automated step in the build process
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A software company builds a containerized Java application using a CI/CD pipeline. The security team needs an SBOM generated automatically for each build so that vulnerability scanning can occur before deployment. The team also wants the SBOM to include dependency relationships and license information. Which approach should the security architect recommend?

   • AUse a CycloneDX plugin in the build tool to generate the SBOM as a build artifact and store it with the container image.
   • BGenerate an SPDX document using a text editor and store it in a shared network drive for the security team to access.
   • CUse a runtime container scanner to generate the SBOM after the image is deployed to production.
   • DManually compile the SBOM from the project's pom.xml file after each release and email it to the security team.
   Reveal Solution Discussion Select an answer first