English
Menu

Cyber Attacks and Defense in Practice

Which of the following is the main purpose of creating and maintaining an SBOM (software bill of materials)?

  1. ATo list the components such as libraries in a product with their versions, so that when a vulnerability in a component is announced, the affected products can be found at once
  2. BTo encrypt the source code of the software so that third parties, including users who bought the product, cannot read the contents of the program
  3. CTo calculate the procurement cost and lead time of components from a list of the semiconductors and electronic components used to build a product, and plan production
Show answer and explanation

Answer: A. To list the components such as libraries in a product with their versions, so that when a vulnerability in a component is announced, the affected products can be found at once

Today's software is built by combining many open-source libraries and third-party components, and components often depend on yet other components. An SBOM is a list of these components with their names, versions, suppliers and dependency relationships in a machine-readable format (such as SPDX or CycloneDX). When a serious vulnerability is found in a widely used component, as with the Log4j vulnerability (Log4Shell) disclosed in December 2021, an SBOM lets you quickly find which versions of which products are affected. In the US, an executive order of May 2021 set out a policy of requiring SBOMs for software supplied to the government.

  • A. Correct. With a list of components, the extent of a vulnerability's impact can be checked immediately.
  • B. An SBOM is a list of components; it does not encrypt source code.
  • C. It is different from the bill of materials (BOM) for electronic components and covers software components.
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. A company uses an internal-only library named acme-utils, kept in its internal package repository (private registry). An attacker registered a package with the same name, acme-utils, and a higher version number in a public package repository, and it turned out that, depending on the build settings, the internal build environment could pull in the attacker's package. Which of the following is the most appropriate countermeasure to this "dependency confusion"?
  2. In the SolarWinds incident discovered in December 2020, attackers got into the build environment of IT management software and malicious code was mixed into legitimate updates. The updates were distributed carrying the developer's legitimate code signature. Which of the following is the most appropriate lesson from this incident?
  3. It was found that files containing customer information in cloud object storage could be read by anyone on the internet. Which of the following is an appropriate combination of a typical cause of this kind of leak and a measure to prevent recurrence?
  4. An access key with administrator privileges allowing all operations (a long-lived credential) was written in a configuration file and given to a batch job running in the cloud. Which of the following is the most appropriate revision to reduce the damage if this key leaks?
  5. An attacker obtained an employee's password and repeated the login dozens of times, flooding the employee's smartphone with notifications asking for approval. The employee got annoyed and pressed "Approve" without thinking. Which of the following is the most appropriate countermeasure to this attack?

Comparisons in this topic