Microsoft Security, Compliance, and Identity Fundamentals (SC-900)Describe the concepts of security, compliance, and identityHard
A software development team needs to ensure that only specific versions of libraries and approved components are used in their applications to prevent known vulnerabilities from being introduced. They also need to track the origin and integrity of all open-source components. Which security concept is primarily concerned with managing and securing the components used in software development?
- AApplication Security Groups
- BSupply Chain Security
- CCode Compliance
- DThreat Protection
Show answer & explanationAnswer & explanation
Correct answer: B. Supply Chain Security
Supply Chain Security focuses on securing all aspects of the software development lifecycle, including vetting and managing third-party components (libraries, open-source code) to prevent vulnerabilities and ensure integrity from source to deployment.
Why the other options are wrong
- A. Application Security Groups (ASGs) are a networking feature in Azure, used to group VMs and define network security policies, unrelated to software components.
- C. Code Compliance ensures code adheres to standards and policies, which might be part of supply chain security, but it's not the overarching concept for managing external components.
- D. Threat Protection involves general measures against various threats but is not specific to component management in software development.
Supply Chain Security
Supply Chain Security in software refers to the measures taken to protect the integrity, confidentiality, and availability of all components, processes, and relationships involved in producing and delivering software, from development to deployment.
- Secures third-party libraries and open-source components.
- Prevents injection of malicious code or vulnerabilities.
- Ensures the integrity of the software artifact from source to production.
Memory trick: Secure the entire software journey, piece by piece.