Describe How to Create and Leverage a SBOM (Software Bill of Materials) in Cybersecurity Defenses. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is a key benefit of incorporating SBOM analysis into a DevSecOps pipeline?

   • AIt automatically fixes all vulnerabilities found in the components
   • BIt speeds up the build process by removing unnecessary components
   • CIt eliminates the need for any other security testing
   • DIt enables continuous monitoring of components for known vulnerabilities
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An organization has a large portfolio of applications and receives a new SBOM for each application after every build. The security team wants to integrate these SBOMs into their existing vulnerability management platform to continuously monitor for known vulnerabilities. What is the most effective integration approach?

   • AAutomatically ingest each SBOM into the vulnerability management platform and correlate component versions with vulnerability feeds.
   • BUse the SBOMs only during incident response to identify affected components.
   • CStore all SBOMs in a shared folder and manually review them once a quarter.
   • DConvert all SBOMs to PDF format and archive them for compliance audits.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In incident response, how can an SBOM be useful?

   • AIt replaces the need for log analysis during incident response
   • BIt provides a list of all network connections made by the software
   • CIt automatically contains forensic evidence of the attack
   • DIt helps identify whether the compromised system contains a vulnerable component
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is a common method for generating an SBOM?

   • AManual enumeration of all components by the development team at the end of the project
   • BExtraction from the software's user manual
   • CAutomated generation from the build process using tools that scan dependencies
   • DDownloading a pre-made SBOM from the software vendor's website
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security architect is evaluating SBOM tools for a multi-language environment. The team needs a tool that can generate SBOMs for Java, Python, and Go applications, and also support both SPDX and CycloneDX output formats. The team also wants to integrate the tool into their CI/CD pipeline. Which factor is most important when selecting the tool?

   • AThe tool must generate SBOMs in a proprietary format for better security.
   • BThe tool must support all three languages and both output formats, and provide a command-line interface for CI/CD integration.
   • CThe tool must be able to generate SBOMs from source code only, without access to the build environment.
   • DThe tool must be open-source and free to use.
   Reveal Solution Discussion Select an answer first