A well organized and disciplined patching process can help prevent:

Exploits against known vulnerabilities.

Patching of vulnerabilities once they have been identified, falls under:

Vulnerability, Tracking and Resolution

Testing requires a set of contractual criteria to judge:

Successful Execution of the test

In terms of risk, all outsourcing decisions should be based on:

Known capability of the supplier

Prequalification of a supplier requires the customer to:

Objectively understand the supplier's development processes.

A Service Level Agreement (SLA) sets the:

performance level of a service between customer & supplier

What is the best hope for preventing theft of intellectual property?

Perform rigorous audits & inspections, & enforce penalties.

Which is NOT a threat to the supply chain?

Alterations to the Service Level Agreement

studbud

Supply Chain and Software Acquisition

20 termsStudBud Administration18 plays

Chapter 20 Quiz (CSSLP book)

Flashcards20 cardsFPractice quizPHost liveL

Questions 20

Answers

1
Supplier transitioning concerns focus on the:
Design Level
Acceptance Level
Interface Level
Code Level
2
A well organized and disciplined patching process can help prevent:
Loss of intellectual property.
Exploits against known vulnerabilities.
license expiration penalties
Exploits against unknown vulnerabilities.
3
A product License is used to certify that:
software cannot be copied.
ensures that trust has been established between 2 entities.
a product is authentic
the software has not been modified
4
Patching of vulnerabilities once they have been identified, falls under:
Sustainment Controls
Vulnerability, Tracking and Resolution
Monitoring and Incident Management
Software Authenticity & Integrity
5
Testing requires a set of contractual criteria to judge:
Successful Execution of the test
Successful completion of the acceptance audit.
Focus and scope of the testing
Whether vendor can be trusted.
6
In terms of risk, all outsourcing decisions should be based on:
Where the supplier is located
Price and performance
Timing of delivery process
Known capability of the supplier
7
Prequalification of a supplier requires the customer to:
determine if the supplier uses licensed subcontractors
Objectively understand the supplier's development processes.
ensure the supplier is listed in ISO 15407.
examine a supplier's reputation.
8
A Service Level Agreement (SLA) sets the:
operational roles & security testing plan
supplier's competence for a project
patch management responsibilities for the project.
performance level of a service between customer & supplier
9
Which of the following is NOT a common software assurance method used for integrity checking?
Audits
Installation
Dynamic Tests
Static Tests
10
What is the best hope for preventing theft of intellectual property?
Perform rigorous audits & inspections, & enforce penalties.
guarantee/enforce the right of possession in supply chain.
Increase awareness in the minds of suppliers and developers
make backup copies for archival purposes
11
Producing synergy from the linkage of all components is the aim of:
System of Systems integration
Software authenticity and Integrity
Supply Chain integration
Product Deployment and Sustainment
12
Which of the following is NOT considered an "incident"?
Power Disruptions
Malicious Activity
User errors
Ambiguous SLA
13
Software authenticity requires controls to ensure:
Good coding Practice
Non-repudiation of origin
Hashing and Checksums
All of these
14
Vulnerability management has a post-delivery focus that is called:
Certification
Validation and Verification
Authentication
Patching
15
Software can contain intellectual property in these forms EXCEPT:
Algorithms
Coding
Processes
Mathematical Formulas
16
Intellectual property is considered:
plagiarism
unchangeable
Abstract
Tangible
17
Security testing controls should evaluate all the technical, process, and:
Cybersecurity risks.
Confidentiality, inspection & authentication risks.
Resourcing risks.
nonrepudiation risks.
18
The third party registry system is colloquially known as:
(VTIC) Vendor Technical Integrity Controls
The Common Criteria
Commercial Off the Shelf (COTS) Listing
the National Information Assurance Program (NIAP)
19
Which is NOT a threat to the supply chain?
Installation of unintentional vulnerabilities.
Installation of Malicious logic in HW/SW
Disrupting the production/distribution of a critical service
Alterations to the Service Level Agreement
20
What is the best place to assure component integrity when transitioning between two suppliers?
Detailed Transitioning plan
Product Deployment Plan
System Integration Plan
Service Level Agreement (SLA)

Supply Chain and Software Acquisition Flashcards | StudBud