CISSP Software Development Security Practice Question
A company is evaluating a third-party software library for use in their application. Which document provides a detailed inventory of the library's components and dependencies to help assess supply chain risk?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Software Bill of Materials (SBOM)
A Software Bill of Materials (SBOM) lists all components and dependencies, aiding vulnerability management and supply chain security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Service Level Agreement (SLA)
Why it's wrong here
A Service Level Agreement (SLA) primarily defines the operational performance, availability, and support metrics that a service provider commits to a customer. While crucial for service delivery expectations, an SLA does not enumerate the specific software components, libraries, or dependencies used within the service or product itself, thus failing to provide the necessary inventory for a software supply chain risk assessment.
- ✗
Data processing agreement
Why it's wrong here
A Data Processing Agreement (DPA) is a legally binding contract that specifies the rights and obligations of a data controller and a data processor concerning the handling of personal data. It outlines data protection measures, data transfer rules, and incident response procedures related to data privacy, but it does not detail the constituent software libraries or open-source components embedded within a third-party application, which is the focus of software supply chain evaluation.
- ✗
Vulnerability disclosure report
Why it's wrong here
A vulnerability disclosure report typically documents specific security weaknesses identified within a system or application, often as part of a bug bounty program or security audit. While it highlights known flaws and their remediation, it does not provide a comprehensive, machine-readable list of all included software components, their versions, and dependencies, which is crucial for a proactive and holistic supply chain risk assessment.
- ✓
Software Bill of Materials (SBOM)
Why this is correct
A Software Bill of Materials (SBOM) is a formal, machine-readable inventory of all software components, including open-source and commercial elements, and their dependencies used in a product. It provides critical transparency into the software supply chain, enabling organizations to proactively identify and track known vulnerabilities, licensing obligations, and potential risks associated with third-party libraries, which is essential for comprehensive risk assessment.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.