Home » Master Class

Category Archives: Master Class

QuickLinks

Blood Request
Gallery
Donor
Case Studies
Reported Cases
News
Jugnoo’s Kit
Privacy Policy

TakeUThere

What We Aim ?
What We Do ?
How We Work ?
Report Us
Testimonial by a Friend
Founder’s Message
Upload a Case Study

News/Events@HB

Recent Events »

#170 – 14th Cyber Security and Cyber Crime Awareness Session, at Ambalika Institute of Professional Studies.
#169 – 13th Cyber Security and Cyber Crime Awareness Session, at KVPF Kerala
#168 – 12th Cyber Security and Cyber Crime Awareness Session, at SKIET Kurukshetra
#167 – 11th Cyber Security and Cyber Crime Awareness Session at PaGE, Ranchi and Hyderabad
#121 World Compliment Day at Sahara Old Age Home
#120 New Year Eve celebrations at Jivodaya and Sai Sahara
#119 Educational Counselling at Hamara Kartyav
#118 Ujjwal – a Day with Chotus – Noida Sector 62
#117 Helping Brainz Green VEINS at GBM, Dwarka
#116 2019 Mother’s Day at Jeevodaya Ashralayaa
#115 CrafTShaala 2019 – Kizhadoor, Thrissur (An empowerment session for the flood effected women)
#114 VanitaJyoti Kochi 2019, A workshop on Women Entrepreneurship and Empowerment.
#113 New Year Celebrations with the grandmas and grandpas of Sai Sahara.
#112 Phase#2 Clothes Donations Drive at West and Central Delhi, on New Year Eve.
#111 Phase#1 Clothes Donations Drive at West and Central Delhi, on Christmas Eve.
#110 Workshop on ‘being a leader’ at Government School in Badshahpur
109# Creative-Crafts Making workshop by Mini Sajan at Annamanada.
#108 VanitaJyoti – Annamanada

3rd TPRM Master Class by International TPRM Alliance

June 27, 2026

TPRM Master Class Series by ITA

3rd TPRM Master Class

Please enter your full name, email address and location for certificate/score-generations! You will receive a certificate only if you score above 70%.

1 / 28

Category: 3rd-TPRMMasterclass

1. What root cause made the XZ Utils attack pattern particularly dangerous and scalable according to the presentation?

A. The attacker compromised the upstream GitHub Actions pipeline and poisoned the release artifacts across all Linux distributions simultaneously

B. A sole maintainer with long-term burnout created a bus factor of one, and attackers target low-maintainer packages using a repeatable and scalable pattern

C. XZ Utils lacked any form of code review, allowing malicious code to be merged without oversight

D. The attacker exploited a zero-day in the SSH protocol that bypassed all authentication mechanisms

2 / 28

Category: 3rd-TPRMMasterclass

2. During the XZ Utils backdoor attack, how was the threat ultimately discovered?

A. A developer noticed an anomalous 500ms latency spike that was traced back to the backdoored library

B. An automated SBOM scanner flagged an unexpected dependency added to the compression library

C. The attacker's GitHub account was flagged by GitHub's security team during a routine audit

D. CISA issued a vulnerability advisory after detecting anomalous SSH traffic patterns across affected servers

3 / 28

Category: 3rd-TPRMMasterclass

3. What does SBOM stand for?

A. Software Build Operations Management

B. Software Bill of Materials

C. System Baseline Operations Monitor

D. Secure Binary Output Module

4 / 28

Category: 3rd-TPRMMasterclass

4. What does DORA require specifically for the financial sector?

A. Mandatory disclosure of all open-source components to regulators

B. ICT third-party risk management for the financial sector from January 2025

C. Annual penetration testing of all software components

D. Real-time SBOM sharing with central banking authorities

5 / 28

Category: 3rd-TPRMMasterclass

5. why do zombie dependencies remain in production undetected?

A. They are hidden inside container base images that are never scanned

B. Security scanners are not configured to scan transitive dependencies

C. They still work and trigger no alerts, while traditional scanners only flag known CVEs not lack of maintenance

D. They are deliberately excluded from SBOMs by developers

6 / 28

Category: 3rd-TPRMMasterclass

6. According to the NTIA Minimum Elements, which of the following is a required field in an SBOM?

A. Source code repository URL and CI/CD pipeline name

B. Unique identifier (CPE or PURL) and dependency relationships

C. License cost and vendor contact information

D. Deployment environment and runtime configuration

7 / 28

Category: 3rd-TPRMMasterclass

7. How does the 'Optimize 12+ months' phase of the Supply Chain Security Roadmap differ from the 'Mature 6-12 months' phase?

A. The Mature phase focuses on vendor SBOMs while the Optimize phase focuses on internal SBOMs

B. The Mature phase handles transitive dependency mapping while the Optimize phase handles direct dependency governance only

C. The Optimize phase introduces manual SBOM review processes to complement the automated pipeline built in the Mature phase

D. The Mature phase enforces policy as code and detects zombie dependencies while the Optimize phase adds RBOM deployment, SLSA provenance verification, SBOM-to-RBOM drift analysis, predictive risk analytics, and open source contribution

8 / 28

Category: 3rd-TPRMMasterclass

8. What is the primary characteristic that makes a dependency a 'zombie dependency'?

A. It is an unmaintained open-source package still running in production

B. It uses deprecated APIs

C. It is written in an old programming language

D. It has more than 10 known CVEs

9 / 28

Category: 3rd-TPRMMasterclass

9. What is the key difference between static SBOM and Runtime Bill of Materials (RBOM)?

A. SBOM covers open-source components while RBOM covers commercial software

B. SBOM captures declared dependencies at build time while RBOM observes components actually executing in production

C. SBOM is generated by security teams while RBOM is generated by developers

D. SBOM uses CycloneDX format while RBOM uses SPDX format

10 / 28

Category: 3rd-TPRMMasterclass

10. An enterprise security team is evaluating whether to standardize on CycloneDX or SPDX for their SBOM format. What guidance does the presentation provide, and why is format standardization critical?

A. CycloneDX is recommended for open-source projects while SPDX is mandatory for regulated industries; mixed formats are acceptable as long as tooling can convert between them

B. Choose either CycloneDX or SPDX and commit organizationally for consistent integration, avoiding mixed-format environments that slow incident response

C. The presentation recommends SPDX because it aligns with NTIA minimum elements and is the only format accepted by the FDA for medical device submissions

D. CycloneDX should be chosen for build-time SBOMs while SPDX is used for runtime observation because each format is optimized for its respective phase

11 / 28

Category: 18th RT-International TPRM Alliance

How would you rate the overall experience of the event?

11. Highly insightful and engaging
Informative and valuable
Average / satisfactory
Lengthy but useful
Too long and less engaging
Not relevant / could be improved

12 / 28

Category: 3rd-TPRMMasterclass

12. According to the Supply Chain Security Roadmap, what activities are included in the 'Foundation' phase (0–3 months)?

A. Deploy RBOM and verify provenance with SLSA

B. Standardize SBOM format, automate SBOM generation, and baseline component inventory

C. Correlate SBOMs with CVE/NVD and adopt VEX

D. Enforce policy as code and detect zombie dependencies

13 / 28

Category: 3rd-TPRMMasterclass

13. According to the presentation, what is the global cost of supply chain attacks in 2025?

A. $20 billion

B. $60 billion

C. $40 billion

D. $100 billion

14 / 28

Category: 3rd-TPRMMasterclass

14. According to the SBOM Best Practices slide, what is the purpose of pairing SBOMs with VEX documents?

A. To state exploitability context and reduce triage load by distinguishing exploitable from non-exploitable vulnerabilities

B. To cryptographically sign the SBOM and bind it to a specific build artifact for provenance verification

C. To synchronize SBOM data across multiple registry formats such as CycloneDX and SPDX simultaneously

D. To automate dependency updates when a VEX document marks a CVE as fixed upstream

15 / 28

Category: 3rd-TPRMMasterclass

15. What is the first stage in the anatomy of a supply chain attack?

A. Execute in Target

B. Distribute via Trust

C. Exfiltrate or Persist

D. Compromise Upstream

16 / 28

Category: 3rd-TPRMMasterclass

16. Which US legislation established SBOM as a national security priority in 2021?

A. NIST SP 800-218

B. FDA Cybersecurity Guidance

C. EU Cyber Resilience Act

D. US Executive Order 14028

17 / 28

Category: 3rd-TPRMMasterclass

17. Which open-source tools are mentioned for creating SBOMs during builds?

A. Jenkins, GitLab, CircleCI

B. Syft, Trivy, Grype

C. Docker, Kubernetes, Helm

D. Snyk, Veracode, Checkmarx

18 / 28

Category: 3rd-TPRMMasterclass

18. A security engineer detects that a library declared in the SBOM at build time is not present when observing runtime behavior. Which RBOM capability directly addresses this scenario?

A. Cryptographic signing of SBOMs with SLSA attestations detects discrepancies post-deployment

B. Continuous CVE alerting integrated with NVD identifies missing components through known vulnerability feeds

C. VEX documents paired with SBOMs reduce triage noise and help identify missing runtime libraries

D. SBOM to RBOM drift detection surfaces unauthorized or unexpected components and phantom dependencies visible at runtime but absent from manifests

19 / 28

Category: 3rd-TPRMMasterclass

19. A threat actor injects malicious code into a trusted npm package, which is then published through the normal registry. A downstream enterprise application that pins to a version range automatically picks up the compromise. Which two phases of the supply chain attack anatomy from the presentation are directly demonstrated here?

A. Distribute via Trust and Execute in Target, because the registry acts as a distribution channel and the malicious payload activates via dependency resolution in CI/CD

B. Compromise Upstream and Execute in Target, because the injection happened at the source repository level and executed directly when the application resolved the dependency

C. Execute in Target and Exfiltrate or Persist, because the malicious code runs inside the enterprise environment and subsequently exfiltrates credentials

D. Compromise Upstream and Distribute via Trust, because the attacker injected code into a trusted package and propagated it through legitimate update channels and package registries

20 / 28

Category: 3rd-TPRMMasterclass

20. An organization wants to reduce triage time when a new critical CVE is disclosed. How does the combination of SBOM and RBOM achieve this according to the presentation?

A. SBOM triggers automated CI/CD rollbacks when a CVE is matched while RBOM monitors traffic for exploit attempts in real time

B. Both SBOM and RBOM together generate VEX documents automatically to communicate exploitability context to downstream consumers

C. SBOM identifies which applications declared the vulnerable library while RBOM confirms which production services are actively loading it right now, together cutting triage from hours to minutes

D. RBOM automates patch deployment to affected services while SBOM documents the remediation for compliance reporting

21 / 28

Category: 18th RT-International TPRM Alliance

21. Please share your feedback on the event

What did you find most valuable?
What could be improved?
Any suggestions for future sessions?

22 / 28

Category: 3rd-TPRMMasterclass

22. According to the 'SBOMs as Mandatory Evidence' , which regulatory frameworks specifically drive the requirement to embed signed, versioned SBOMs?

A. ISO 27001, NIST CSF, and FedRAMP

B. GDPR, ePrivacy Directive, and UK Cyber Essentials

C. PCI DSS, HIPAA, and SOC 2 Type II

D. EU CRA, DORA, and NIS2

23 / 28

Category: 3rd-TPRMMasterclass

23. When did the EU Cyber Resilience Act enter into force?

A. March 2025

B. January 2023

C. June 2024

D. December 2024

24 / 28

Category: 3rd-TPRMMasterclass

24. In the context of vulnerability correlation in the SBOM maturity pipeline, which scoring systems are applied?

A. CVSS and EPSS scoring, integrated with VEX and continuous alerting

B. ISO 27001 and SOC 2 risk ratings

C. OWASP Top 10 severity levels and PCI DSS tiers

D. NVD criticality bands and vendor patch priority scores

25 / 28

Category: 3rd-TPRMMasterclass

25. Which attestation frameworks are mentioned for verifying SBOM provenance?

A. ISO 27001 and FedRAMP

B. NIST CSF and CIS Controls

C. SLSA and Sigstore

D. SOC 2 Type II and PCI DSS

26 / 28

Category: 18th RT-International TPRM Alliance

Which topics would you like to see covered in future roundtables or masterclasses?
e.g.,

26. Third-Party Cyber Risk & Continuous Monitoring
AI Risk in Vendor Ecosystems
Cloud & SaaS Risk Management
Regulatory Compliance (e.g., outsourcing, data protection)
Fourth-Party / Concentration Risk
Incident & Breach Management involving vendors
Other (please specify): __________

27 / 28

Category: 3rd-TPRMMasterclass

27. What was the CVE identifier associated with the XZ Utils backdoor incident in March 2024?

A. CVE-2024-3094

B. CVE-2023-4455

C. CVE-2024-9876

D. CVE-2024-1234

28 / 28

Category: 3rd-TPRMMasterclass

28. What does RBOM stand for?

A. Runtime Bill of Materials

B. Repository-Based Object Mapping

C. Runtime Binary Operations Monitor

D. Remote Bill of Materials

Your score is

LinkedIn Facebook Twitter

Exit

2nd TPRM Master Class by International TPRM Alliance

May 23, 2026

The quiz has expired!

1st TPRM Master Class by International TPRM Alliance

May 9, 2026

The quiz has expired!

Quiz-time

Cyber Security Awarness Quiz Day 2

Denzel Washington Motivational & Inspiring Commencement Speech

Enrich your day

Blogs by HelpingBrainz »

Women Empowerment Month 2022
WhatsApp Use Survey
Role of NGOs in curbing unemployment
Linking Shopkeeper-Needy Model
Baby Nagma requires your support.
#DelhiTurkmanGate – LockdownDonations
ImportantDays
An article about Helping Brainz’s Child Empowerment Initiative “Paint Your Dreams” – Mathrubhumi

Category Archives: Master Class

QuickLinks

TakeUThere

News/Events@HB

Quiz-time

Denzel Washington Motivational & Inspiring Commencement Speech

Enrich your day

Tweet

YouTube

Contact Us