SY0-701 Security Program Management and Oversight Practice Question
A software supplier used by your company is adding a new library to its product and says the change is "internal only." Your security team wants better visibility into future component risks before the next renewal. What requirement would BEST support supply chain due diligence?
⚠ Common exam trap
Watch out — candidates often think a marketing summary or a promise of no vulnerabilities is sufficient for due diligence, but CompTIA emphasizes that only a verifiable, technical artifact like an SBOM with change notifications provides the visibility required for ongoing risk management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require an updated software bill of materials and a notification process for material component changes.
A Software Bill of Materials (SBOM) provides a detailed inventory of all components in a product, enabling the security team to assess risks from new libraries. Requiring an SBOM plus a notification process for material changes gives proactive visibility into component risks, directly supporting supply chain due diligence as recommended by frameworks like NIST SP 800-161.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Require the supplier to provide a marketing summary of its development process.
Why it's wrong here
A marketing summary is a curated, promotional artifact that is not independently verifiable and typically omits the technical specifics needed for supply chain risk assessment. Due diligence requires objective evidence such as SBOMs, security test results, or compliance attestations, not self-reported narratives. Marketing materials do not provide assurance about how vulnerabilities are discovered, patched, or communicated.
- ✓
Require an updated software bill of materials and a notification process for material component changes.
Why this is correct
This is the best requirement because it improves transparency and ongoing risk awareness. An updated software bill of materials helps the organization understand what is inside the product, while a formal notification process ensures material changes are communicated before they create surprise exposure. Together, these controls support continuous supply chain due diligence rather than a one-time review at purchase time.
- ✗
Ask the supplier to promise that future vulnerabilities will never affect the product.
Why it's wrong here
A promise that future vulnerabilities will never affect the product is technologically impossible and legally unenforceable because all software contains latent defects given its complexity and evolving threat landscape. Such an absolute assurance would actually mask risk rather than manage it, as the supplier may avoid honest disclosure. A practical requirement is a documented vulnerability handling policy, including responsible disclosure, patch SLAs, and notification triggers.
- ✗
Approve the change if the new library is open source and widely used.
Why it's wrong here
Adopting a library solely because it is open source and widely used is a fallacy; popularity correlates with attack surface and scrutiny but not necessarily with security, as demonstrated by major vulnerabilities in ubiquitous projects like OpenSSL and Log4j. An open-source license also does not ensure active maintenance, security audits, or prompt patching, and it introduces licensing and compliance obligations. The decision must be based on a risk assessment that includes the library's vulnerability history, maintenance status, and the supplier's ability to monitor and update it.
Go deeper
Related to this question
Learn chapter
Compliance and Regulatory Frameworks
Key term
Due diligence
Due diligence is the process of systematically reviewing and verifying information, policies, and procedures to identify and manage risks before making a decision or taking an action in an IT or security context.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.