3rd TPRM Master Class by International TPRM Alliance

TPRM Master Class Series by ITA

3rd TPRM Master Class

Please enter your full name, email address and location for certificate/score-generations! You will receive a certificate only if you score above 70%.

1 / 28

Category: 3rd-TPRMMasterclass

1. why do zombie dependencies remain in production undetected?

A. Security scanners are not configured to scan transitive dependencies

B. They still work and trigger no alerts, while traditional scanners only flag known CVEs not lack of maintenance

C. They are hidden inside container base images that are never scanned

D. They are deliberately excluded from SBOMs by developers

2 / 28

Category: 3rd-TPRMMasterclass

2. What is the first stage in the anatomy of a supply chain attack?

A. Exfiltrate or Persist

B. Compromise Upstream

C. Distribute via Trust

D. Execute in Target

3 / 28

Category: 18th RT-International TPRM Alliance

How would you rate the overall experience of the event?

3. Highly insightful and engaging
Informative and valuable
Average / satisfactory
Lengthy but useful
Too long and less engaging
Not relevant / could be improved

4 / 28

Category: 3rd-TPRMMasterclass

4. How does the 'Optimize 12+ months' phase of the Supply Chain Security Roadmap differ from the 'Mature 6-12 months' phase?

A. The Mature phase enforces policy as code and detects zombie dependencies while the Optimize phase adds RBOM deployment, SLSA provenance verification, SBOM-to-RBOM drift analysis, predictive risk analytics, and open source contribution

B. The Optimize phase introduces manual SBOM review processes to complement the automated pipeline built in the Mature phase

C. The Mature phase handles transitive dependency mapping while the Optimize phase handles direct dependency governance only

D. The Mature phase focuses on vendor SBOMs while the Optimize phase focuses on internal SBOMs

5 / 28

Category: 3rd-TPRMMasterclass

5. What does SBOM stand for?

A. Secure Binary Output Module

B. Software Build Operations Management

C. Software Bill of Materials

D. System Baseline Operations Monitor

6 / 28

Category: 3rd-TPRMMasterclass

6. According to the SBOM Best Practices slide, what is the purpose of pairing SBOMs with VEX documents?

A. To synchronize SBOM data across multiple registry formats such as CycloneDX and SPDX simultaneously

B. To cryptographically sign the SBOM and bind it to a specific build artifact for provenance verification

C. To state exploitability context and reduce triage load by distinguishing exploitable from non-exploitable vulnerabilities

D. To automate dependency updates when a VEX document marks a CVE as fixed upstream

7 / 28

Category: 18th RT-International TPRM Alliance

7. Please share your feedback on the event

What did you find most valuable?
What could be improved?
Any suggestions for future sessions?

8 / 28

Category: 3rd-TPRMMasterclass

8. What is the primary characteristic that makes a dependency a 'zombie dependency'?

A. It is an unmaintained open-source package still running in production

B. It uses deprecated APIs

C. It has more than 10 known CVEs

D. It is written in an old programming language

9 / 28

Category: 3rd-TPRMMasterclass

9. In the context of vulnerability correlation in the SBOM maturity pipeline, which scoring systems are applied?

A. OWASP Top 10 severity levels and PCI DSS tiers

B. ISO 27001 and SOC 2 risk ratings

C. NVD criticality bands and vendor patch priority scores

D. CVSS and EPSS scoring, integrated with VEX and continuous alerting

10 / 28

Category: 3rd-TPRMMasterclass

10. During the XZ Utils backdoor attack, how was the threat ultimately discovered?

A. CISA issued a vulnerability advisory after detecting anomalous SSH traffic patterns across affected servers

B. A developer noticed an anomalous 500ms latency spike that was traced back to the backdoored library

C. The attacker's GitHub account was flagged by GitHub's security team during a routine audit

D. An automated SBOM scanner flagged an unexpected dependency added to the compression library

11 / 28

Category: 3rd-TPRMMasterclass

11. An enterprise security team is evaluating whether to standardize on CycloneDX or SPDX for their SBOM format. What guidance does the presentation provide, and why is format standardization critical?

A. The presentation recommends SPDX because it aligns with NTIA minimum elements and is the only format accepted by the FDA for medical device submissions

B. Choose either CycloneDX or SPDX and commit organizationally for consistent integration, avoiding mixed-format environments that slow incident response

C. CycloneDX is recommended for open-source projects while SPDX is mandatory for regulated industries; mixed formats are acceptable as long as tooling can convert between them

D. CycloneDX should be chosen for build-time SBOMs while SPDX is used for runtime observation because each format is optimized for its respective phase

12 / 28

Category: 3rd-TPRMMasterclass

12. What root cause made the XZ Utils attack pattern particularly dangerous and scalable according to the presentation?

A. The attacker compromised the upstream GitHub Actions pipeline and poisoned the release artifacts across all Linux distributions simultaneously

B. XZ Utils lacked any form of code review, allowing malicious code to be merged without oversight

C. The attacker exploited a zero-day in the SSH protocol that bypassed all authentication mechanisms

D. A sole maintainer with long-term burnout created a bus factor of one, and attackers target low-maintainer packages using a repeatable and scalable pattern

13 / 28

Category: 3rd-TPRMMasterclass

13. According to the 'SBOMs as Mandatory Evidence' , which regulatory frameworks specifically drive the requirement to embed signed, versioned SBOMs?

A. EU CRA, DORA, and NIS2

B. GDPR, ePrivacy Directive, and UK Cyber Essentials

C. ISO 27001, NIST CSF, and FedRAMP

D. PCI DSS, HIPAA, and SOC 2 Type II

14 / 28

Category: 3rd-TPRMMasterclass

14. Which US legislation established SBOM as a national security priority in 2021?

A. FDA Cybersecurity Guidance

B. US Executive Order 14028

C. NIST SP 800-218

D. EU Cyber Resilience Act

15 / 28

Category: 3rd-TPRMMasterclass

15. According to the presentation, what is the global cost of supply chain attacks in 2025?

A. $40 billion

B. $100 billion

C. $20 billion

D. $60 billion

16 / 28

Category: 3rd-TPRMMasterclass

16. Which attestation frameworks are mentioned for verifying SBOM provenance?

A. NIST CSF and CIS Controls

B. ISO 27001 and FedRAMP

C. SOC 2 Type II and PCI DSS

D. SLSA and Sigstore

17 / 28

Category: 3rd-TPRMMasterclass

17. What does RBOM stand for?

A. Repository-Based Object Mapping

B. Runtime Bill of Materials

C. Remote Bill of Materials

D. Runtime Binary Operations Monitor

18 / 28

Category: 3rd-TPRMMasterclass

18. When did the EU Cyber Resilience Act enter into force?

A. December 2024

B. March 2025

C. June 2024

D. January 2023

19 / 28

Category: 3rd-TPRMMasterclass

19. What does DORA require specifically for the financial sector?

A. Real-time SBOM sharing with central banking authorities

B. ICT third-party risk management for the financial sector from January 2025

C. Mandatory disclosure of all open-source components to regulators

D. Annual penetration testing of all software components

20 / 28

Category: 3rd-TPRMMasterclass

20. What is the key difference between static SBOM and Runtime Bill of Materials (RBOM)?

A. SBOM uses CycloneDX format while RBOM uses SPDX format

B. SBOM captures declared dependencies at build time while RBOM observes components actually executing in production

C. SBOM is generated by security teams while RBOM is generated by developers

D. SBOM covers open-source components while RBOM covers commercial software

21 / 28

Category: 3rd-TPRMMasterclass

21. Which open-source tools are mentioned for creating SBOMs during builds?

A. Syft, Trivy, Grype

B. Jenkins, GitLab, CircleCI

C. Snyk, Veracode, Checkmarx

D. Docker, Kubernetes, Helm

22 / 28

Category: 3rd-TPRMMasterclass

22. What was the CVE identifier associated with the XZ Utils backdoor incident in March 2024?

A. CVE-2024-1234

B. CVE-2024-3094

C. CVE-2024-9876

D. CVE-2023-4455

23 / 28

Category: 18th RT-International TPRM Alliance

Which topics would you like to see covered in future roundtables or masterclasses?
e.g.,

23. Third-Party Cyber Risk & Continuous Monitoring
AI Risk in Vendor Ecosystems
Cloud & SaaS Risk Management
Regulatory Compliance (e.g., outsourcing, data protection)
Fourth-Party / Concentration Risk
Incident & Breach Management involving vendors
Other (please specify): __________

24 / 28

Category: 3rd-TPRMMasterclass

24. According to the NTIA Minimum Elements, which of the following is a required field in an SBOM?

A. License cost and vendor contact information

B. Unique identifier (CPE or PURL) and dependency relationships

C. Source code repository URL and CI/CD pipeline name

D. Deployment environment and runtime configuration

25 / 28

Category: 3rd-TPRMMasterclass

25. An organization wants to reduce triage time when a new critical CVE is disclosed. How does the combination of SBOM and RBOM achieve this according to the presentation?

A. SBOM identifies which applications declared the vulnerable library while RBOM confirms which production services are actively loading it right now, together cutting triage from hours to minutes

B. SBOM triggers automated CI/CD rollbacks when a CVE is matched while RBOM monitors traffic for exploit attempts in real time

C. Both SBOM and RBOM together generate VEX documents automatically to communicate exploitability context to downstream consumers

D. RBOM automates patch deployment to affected services while SBOM documents the remediation for compliance reporting

26 / 28

Category: 3rd-TPRMMasterclass

26. A security engineer detects that a library declared in the SBOM at build time is not present when observing runtime behavior. Which RBOM capability directly addresses this scenario?

A. Cryptographic signing of SBOMs with SLSA attestations detects discrepancies post-deployment

B. VEX documents paired with SBOMs reduce triage noise and help identify missing runtime libraries

C. SBOM to RBOM drift detection surfaces unauthorized or unexpected components and phantom dependencies visible at runtime but absent from manifests

D. Continuous CVE alerting integrated with NVD identifies missing components through known vulnerability feeds

27 / 28

Category: 3rd-TPRMMasterclass

27. According to the Supply Chain Security Roadmap, what activities are included in the 'Foundation' phase (0–3 months)?

A. Standardize SBOM format, automate SBOM generation, and baseline component inventory

B. Enforce policy as code and detect zombie dependencies

C. Correlate SBOMs with CVE/NVD and adopt VEX

D. Deploy RBOM and verify provenance with SLSA

28 / 28

Category: 3rd-TPRMMasterclass

28. A threat actor injects malicious code into a trusted npm package, which is then published through the normal registry. A downstream enterprise application that pins to a version range automatically picks up the compromise. Which two phases of the supply chain attack anatomy from the presentation are directly demonstrated here?

A. Execute in Target and Exfiltrate or Persist, because the malicious code runs inside the enterprise environment and subsequently exfiltrates credentials

B. Distribute via Trust and Execute in Target, because the registry acts as a distribution channel and the malicious payload activates via dependency resolution in CI/CD

C. Compromise Upstream and Execute in Target, because the injection happened at the source repository level and executed directly when the application resolved the dependency

D. Compromise Upstream and Distribute via Trust, because the attacker injected code into a trusted package and propagated it through legitimate update channels and package registries

Your score is

0%

Exit

Helping Brainz

QuickLinks

TakeUThere

News/Events@HB

Recent Events »

#170 – 14th Cyber Security and Cyber Crime Awareness Session, at Ambalika Institute of Professional Studies.

#169 – 13th Cyber Security and Cyber Crime Awareness Session, at KVPF Kerala

#168 – 12th Cyber Security and Cyber Crime Awareness Session, at SKIET Kurukshetra

#167 – 11th Cyber Security and Cyber Crime Awareness Session at PaGE, Ranchi and Hyderabad

#121 World Compliment Day at Sahara Old Age Home

#120 New Year Eve celebrations at Jivodaya and Sai Sahara

#119 Educational Counselling at Hamara Kartyav

#118 Ujjwal – a Day with Chotus – Noida Sector 62

#117 Helping Brainz Green VEINS at GBM, Dwarka

#116 2019 Mother’s Day at Jeevodaya Ashralayaa

#115 CrafTShaala 2019 – Kizhadoor, Thrissur (An empowerment session for the flood effected women)

#114 VanitaJyoti Kochi 2019, A workshop on Women Entrepreneurship and Empowerment.

#113 New Year Celebrations with the grandmas and grandpas of Sai Sahara.

#112 Phase#2 Clothes Donations Drive at West and Central Delhi, on New Year Eve.

#111 Phase#1 Clothes Donations Drive at West and Central Delhi, on Christmas Eve.

#110 Workshop on ‘being a leader’ at Government School in Badshahpur

109# Creative-Crafts Making workshop by Mini Sajan at Annamanada.

#108 VanitaJyoti – Annamanada

3rd TPRM Master Class by International TPRM Alliance

Quiz-time

Denzel Washington Motivational & Inspiring Commencement Speech

Enrich your day

Blogs by HelpingBrainz »

Women Empowerment Month 2022

WhatsApp Use Survey

Role of NGOs in curbing unemployment

Linking Shopkeeper-Needy Model

Baby Nagma requires your support.

#DelhiTurkmanGate – LockdownDonations

ImportantDays

An article about Helping Brainz’s Child Empowerment Initiative “Paint Your Dreams” – Mathrubhumi

Tweet

YouTube

Contact Us

QuickLinks

TakeUThere

News/Events@HB

3rd TPRM Master Class by International TPRM Alliance

Quiz-time

Denzel Washington Motivational & Inspiring Commencement Speech

Email Newsletter

Enrich your day

Tweet

YouTube

Contact Us