Supply Chain and Third Party Security Questions

Understanding and assessing risks introduced by vendors, partners, contractors, and software dependencies. Candidates should be able to describe common third party attack vectors, how an adversary can leverage a trusted third party to reach primary targets, methods for discovering and testing dependencies, and practical controls such as secure procurement practices, contractual requirements, software bill of materials, vendor risk assessments, and monitoring for anomalous behavior. Remediation and mitigation strategies should be framed in business and technical terms.