3rd TPRM Master Class by International TPRM Alliance

TPRM Master Class Series by ITA

3rd TPRM Master Class

Please enter your full name, email address and location for certificate/score-generations! You will receive a certificate only if you score above 70%.

1 / 28

Category: 3rd-TPRMMasterclass

1. A security engineer detects that a library declared in the SBOM at build time is not present when observing runtime behavior. Which RBOM capability directly addresses this scenario?

A. VEX documents paired with SBOMs reduce triage noise and help identify missing runtime libraries

B. Continuous CVE alerting integrated with NVD identifies missing components through known vulnerability feeds

C. Cryptographic signing of SBOMs with SLSA attestations detects discrepancies post-deployment

D. SBOM to RBOM drift detection surfaces unauthorized or unexpected components and phantom dependencies visible at runtime but absent from manifests

2 / 28

Category: 3rd-TPRMMasterclass

2. What was the CVE identifier associated with the XZ Utils backdoor incident in March 2024?

A. CVE-2024-1234

B. CVE-2024-9876

C. CVE-2024-3094

D. CVE-2023-4455

3 / 28

Category: 3rd-TPRMMasterclass

3. What does DORA require specifically for the financial sector?

A. ICT third-party risk management for the financial sector from January 2025

B. Mandatory disclosure of all open-source components to regulators

C. Annual penetration testing of all software components

D. Real-time SBOM sharing with central banking authorities

4 / 28

Category: 3rd-TPRMMasterclass

4. In the context of vulnerability correlation in the SBOM maturity pipeline, which scoring systems are applied?

A. NVD criticality bands and vendor patch priority scores

B. CVSS and EPSS scoring, integrated with VEX and continuous alerting

C. OWASP Top 10 severity levels and PCI DSS tiers

D. ISO 27001 and SOC 2 risk ratings

5 / 28

Category: 3rd-TPRMMasterclass

5. What does RBOM stand for?

A. Repository-Based Object Mapping

B. Remote Bill of Materials

C. Runtime Binary Operations Monitor

D. Runtime Bill of Materials

6 / 28

Category: 18th RT-International TPRM Alliance

How would you rate the overall experience of the event?

6. Highly insightful and engaging
Informative and valuable
Average / satisfactory
Lengthy but useful
Too long and less engaging
Not relevant / could be improved

7 / 28

Category: 3rd-TPRMMasterclass

7. why do zombie dependencies remain in production undetected?

A. They still work and trigger no alerts, while traditional scanners only flag known CVEs not lack of maintenance

B. They are hidden inside container base images that are never scanned

C. Security scanners are not configured to scan transitive dependencies

D. They are deliberately excluded from SBOMs by developers

8 / 28

Category: 3rd-TPRMMasterclass

8. When did the EU Cyber Resilience Act enter into force?

A. December 2024

B. June 2024

C. March 2025

D. January 2023

9 / 28

Category: 3rd-TPRMMasterclass

9. A threat actor injects malicious code into a trusted npm package, which is then published through the normal registry. A downstream enterprise application that pins to a version range automatically picks up the compromise. Which two phases of the supply chain attack anatomy from the presentation are directly demonstrated here?

A. Compromise Upstream and Distribute via Trust, because the attacker injected code into a trusted package and propagated it through legitimate update channels and package registries

B. Compromise Upstream and Execute in Target, because the injection happened at the source repository level and executed directly when the application resolved the dependency

C. Distribute via Trust and Execute in Target, because the registry acts as a distribution channel and the malicious payload activates via dependency resolution in CI/CD

D. Execute in Target and Exfiltrate or Persist, because the malicious code runs inside the enterprise environment and subsequently exfiltrates credentials

10 / 28

Category: 3rd-TPRMMasterclass

10. What is the primary characteristic that makes a dependency a 'zombie dependency'?

A. It is written in an old programming language

B. It is an unmaintained open-source package still running in production

C. It has more than 10 known CVEs

D. It uses deprecated APIs

11 / 28

Category: 3rd-TPRMMasterclass

11. What root cause made the XZ Utils attack pattern particularly dangerous and scalable according to the presentation?

A. The attacker exploited a zero-day in the SSH protocol that bypassed all authentication mechanisms

B. The attacker compromised the upstream GitHub Actions pipeline and poisoned the release artifacts across all Linux distributions simultaneously

C. A sole maintainer with long-term burnout created a bus factor of one, and attackers target low-maintainer packages using a repeatable and scalable pattern

D. XZ Utils lacked any form of code review, allowing malicious code to be merged without oversight

12 / 28

Category: 3rd-TPRMMasterclass

12. What is the key difference between static SBOM and Runtime Bill of Materials (RBOM)?

A. SBOM captures declared dependencies at build time while RBOM observes components actually executing in production

B. SBOM covers open-source components while RBOM covers commercial software

C. SBOM uses CycloneDX format while RBOM uses SPDX format

D. SBOM is generated by security teams while RBOM is generated by developers

13 / 28

Category: 18th RT-International TPRM Alliance

Which topics would you like to see covered in future roundtables or masterclasses?
e.g.,

13. Third-Party Cyber Risk & Continuous Monitoring
AI Risk in Vendor Ecosystems
Cloud & SaaS Risk Management
Regulatory Compliance (e.g., outsourcing, data protection)
Fourth-Party / Concentration Risk
Incident & Breach Management involving vendors
Other (please specify): __________

14 / 28

Category: 3rd-TPRMMasterclass

14. According to the Supply Chain Security Roadmap, what activities are included in the 'Foundation' phase (0–3 months)?

A. Standardize SBOM format, automate SBOM generation, and baseline component inventory

B. Correlate SBOMs with CVE/NVD and adopt VEX

C. Enforce policy as code and detect zombie dependencies

D. Deploy RBOM and verify provenance with SLSA

15 / 28

Category: 3rd-TPRMMasterclass

15. What does SBOM stand for?

A. Secure Binary Output Module

B. System Baseline Operations Monitor

C. Software Build Operations Management

D. Software Bill of Materials

16 / 28

Category: 3rd-TPRMMasterclass

16. Which attestation frameworks are mentioned for verifying SBOM provenance?

A. SOC 2 Type II and PCI DSS

B. ISO 27001 and FedRAMP

C. SLSA and Sigstore

D. NIST CSF and CIS Controls

17 / 28

Category: 3rd-TPRMMasterclass

17. According to the presentation, what is the global cost of supply chain attacks in 2025?

A. $60 billion

B. $100 billion

C. $20 billion

D. $40 billion

18 / 28

Category: 3rd-TPRMMasterclass

18. According to the SBOM Best Practices slide, what is the purpose of pairing SBOMs with VEX documents?

A. To synchronize SBOM data across multiple registry formats such as CycloneDX and SPDX simultaneously

B. To automate dependency updates when a VEX document marks a CVE as fixed upstream

C. To state exploitability context and reduce triage load by distinguishing exploitable from non-exploitable vulnerabilities

D. To cryptographically sign the SBOM and bind it to a specific build artifact for provenance verification

19 / 28

Category: 3rd-TPRMMasterclass

19. According to the NTIA Minimum Elements, which of the following is a required field in an SBOM?

A. Source code repository URL and CI/CD pipeline name

B. Unique identifier (CPE or PURL) and dependency relationships

C. License cost and vendor contact information

D. Deployment environment and runtime configuration

20 / 28

Category: 3rd-TPRMMasterclass

20. An enterprise security team is evaluating whether to standardize on CycloneDX or SPDX for their SBOM format. What guidance does the presentation provide, and why is format standardization critical?

A. CycloneDX is recommended for open-source projects while SPDX is mandatory for regulated industries; mixed formats are acceptable as long as tooling can convert between them

B. Choose either CycloneDX or SPDX and commit organizationally for consistent integration, avoiding mixed-format environments that slow incident response

C. CycloneDX should be chosen for build-time SBOMs while SPDX is used for runtime observation because each format is optimized for its respective phase

D. The presentation recommends SPDX because it aligns with NTIA minimum elements and is the only format accepted by the FDA for medical device submissions

21 / 28

Category: 3rd-TPRMMasterclass

21. Which US legislation established SBOM as a national security priority in 2021?

A. EU Cyber Resilience Act

B. FDA Cybersecurity Guidance

C. NIST SP 800-218

D. US Executive Order 14028

22 / 28

Category: 3rd-TPRMMasterclass

22. According to the 'SBOMs as Mandatory Evidence' , which regulatory frameworks specifically drive the requirement to embed signed, versioned SBOMs?

A. EU CRA, DORA, and NIS2

B. GDPR, ePrivacy Directive, and UK Cyber Essentials

C. ISO 27001, NIST CSF, and FedRAMP

D. PCI DSS, HIPAA, and SOC 2 Type II

23 / 28

Category: 18th RT-International TPRM Alliance

23. Please share your feedback on the event

What did you find most valuable?
What could be improved?
Any suggestions for future sessions?

24 / 28

Category: 3rd-TPRMMasterclass

24. How does the 'Optimize 12+ months' phase of the Supply Chain Security Roadmap differ from the 'Mature 6-12 months' phase?

A. The Optimize phase introduces manual SBOM review processes to complement the automated pipeline built in the Mature phase

B. The Mature phase focuses on vendor SBOMs while the Optimize phase focuses on internal SBOMs

C. The Mature phase handles transitive dependency mapping while the Optimize phase handles direct dependency governance only

D. The Mature phase enforces policy as code and detects zombie dependencies while the Optimize phase adds RBOM deployment, SLSA provenance verification, SBOM-to-RBOM drift analysis, predictive risk analytics, and open source contribution

25 / 28

Category: 3rd-TPRMMasterclass

25. What is the first stage in the anatomy of a supply chain attack?

A. Exfiltrate or Persist

B. Execute in Target

C. Compromise Upstream

D. Distribute via Trust

26 / 28

Category: 3rd-TPRMMasterclass

26. Which open-source tools are mentioned for creating SBOMs during builds?

A. Jenkins, GitLab, CircleCI

B. Snyk, Veracode, Checkmarx

C. Syft, Trivy, Grype

D. Docker, Kubernetes, Helm

27 / 28

Category: 3rd-TPRMMasterclass

27. An organization wants to reduce triage time when a new critical CVE is disclosed. How does the combination of SBOM and RBOM achieve this according to the presentation?

A. Both SBOM and RBOM together generate VEX documents automatically to communicate exploitability context to downstream consumers

B. RBOM automates patch deployment to affected services while SBOM documents the remediation for compliance reporting

C. SBOM identifies which applications declared the vulnerable library while RBOM confirms which production services are actively loading it right now, together cutting triage from hours to minutes

D. SBOM triggers automated CI/CD rollbacks when a CVE is matched while RBOM monitors traffic for exploit attempts in real time

28 / 28

Category: 3rd-TPRMMasterclass

28. During the XZ Utils backdoor attack, how was the threat ultimately discovered?

A. CISA issued a vulnerability advisory after detecting anomalous SSH traffic patterns across affected servers

B. An automated SBOM scanner flagged an unexpected dependency added to the compression library

C. The attacker's GitHub account was flagged by GitHub's security team during a routine audit

D. A developer noticed an anomalous 500ms latency spike that was traced back to the backdoored library

Your score is

0%

Exit

Helping Brainz

QuickLinks

TakeUThere

News/Events@HB

Recent Events »

#170 – 14th Cyber Security and Cyber Crime Awareness Session, at Ambalika Institute of Professional Studies.

#169 – 13th Cyber Security and Cyber Crime Awareness Session, at KVPF Kerala

#168 – 12th Cyber Security and Cyber Crime Awareness Session, at SKIET Kurukshetra

#167 – 11th Cyber Security and Cyber Crime Awareness Session at PaGE, Ranchi and Hyderabad

#121 World Compliment Day at Sahara Old Age Home

#120 New Year Eve celebrations at Jivodaya and Sai Sahara

#119 Educational Counselling at Hamara Kartyav

#118 Ujjwal – a Day with Chotus – Noida Sector 62

#117 Helping Brainz Green VEINS at GBM, Dwarka

#116 2019 Mother’s Day at Jeevodaya Ashralayaa

#115 CrafTShaala 2019 – Kizhadoor, Thrissur (An empowerment session for the flood effected women)

#114 VanitaJyoti Kochi 2019, A workshop on Women Entrepreneurship and Empowerment.

#113 New Year Celebrations with the grandmas and grandpas of Sai Sahara.

#112 Phase#2 Clothes Donations Drive at West and Central Delhi, on New Year Eve.

#111 Phase#1 Clothes Donations Drive at West and Central Delhi, on Christmas Eve.

#110 Workshop on ‘being a leader’ at Government School in Badshahpur

109# Creative-Crafts Making workshop by Mini Sajan at Annamanada.

#108 VanitaJyoti – Annamanada

3rd TPRM Master Class by International TPRM Alliance

Quiz-time

Denzel Washington Motivational & Inspiring Commencement Speech

Enrich your day

Blogs by HelpingBrainz »

Women Empowerment Month 2022

WhatsApp Use Survey

Role of NGOs in curbing unemployment

Linking Shopkeeper-Needy Model

Baby Nagma requires your support.

#DelhiTurkmanGate – LockdownDonations

ImportantDays

An article about Helping Brainz’s Child Empowerment Initiative “Paint Your Dreams” – Mathrubhumi

Tweet

YouTube

Contact Us

QuickLinks

TakeUThere

News/Events@HB

3rd TPRM Master Class by International TPRM Alliance

Quiz-time

Denzel Washington Motivational & Inspiring Commencement Speech

Email Newsletter

Enrich your day

Tweet

YouTube

Contact Us