A development team uses a monorepo containing multiple microservices. They want to generate a single SBOM for the entire repository during their CI pipeline. The team uses a mix of Python and Go services. What is the most appropriate way to generate the SBOM?

Generate an SBOM only for the Python services and ignore the Go services.

Generate a separate SBOM for each service and combine them manually into a single document.

Create a single SBOM by listing only the top-level dependencies of each service.

Use a tool that scans the entire repository and generates a unified SBOM in CycloneDX format.

What is a secure way to share SBOMs with external stakeholders?

Printing them and mailing them via postal service

Emailing them as plain text attachments

Posting them on a public website for easy access

Using encrypted channels and access controls to protect the SBOM data

Why is it important to keep SBOMs up-to-date?

Because SBOMs are only valid for 30 days after creation

Because SBOMs are required to be updated daily by law

Because outdated SBOMs can lead to missed vulnerabilities and inaccurate risk assessments

Because SBOMs become corrupted over time

A security architect is presenting a business case for implementing an SBOM program. The CISO asks how SBOMs will improve the organization's ability to respond to a future zero-day vulnerability in a widely used open-source component. What is the most compelling argument the architect can make?

SBOMs will automatically patch the vulnerable component.

SBOMs will allow the organization to quickly identify all affected applications and prioritize patching based on business impact.

SBOMs will prevent zero-day vulnerabilities from being exploited.

SBOMs will eliminate the need for vulnerability scanning.

SplunkCertified Cybersecurity Defense Architect

Domain 5Objective 3

Describe How to Create and Leverage a SBOM (Software Bill of Materials) in Cybersecurity Defenses. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 5)

Part of the Scaling Cybersecurity Defenses and DevSecOps domain, which accounts for 15% of the CYBERSECURITY-DEFENSE-ARCHITECT exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

8concepts

15%of the exam

Questions 21–25

21foundation · easy
Which of the following are common standards for SBOM formats?
Select an answer first
22application · medium
A development team uses a monorepo containing multiple microservices. They want to generate a single SBOM for the entire repository during their CI pipeline. The team uses a mix of Python and Go services. What is the most appropriate way to generate the SBOM?
Select an answer first
23foundation · easy
What is a secure way to share SBOMs with external stakeholders?
Select an answer first
24foundation · easy
Why is it important to keep SBOMs up-to-date?
Select an answer first
25expert · hard
A security architect is presenting a business case for implementing an SBOM program. The CISO asks how SBOMs will improve the organization's ability to respond to a future zero-day vulnerability in a widely used open-source component. What is the most compelling argument the architect can make?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CYBERSECURITY-DEFENSE-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CYBERSECURITY-DEFENSE-ARCHITECT” is a trademark of its owner, used for identification only.