What is a supply chain attack and how can it be mitigated?

• A. Attacks on network layer only; mitigations include firewall rules.
• B. Attack on end-user devices after delivery; mitigations include antivirus updates.
• C. Compromise of software/components before delivery; mitigations include SBOMs, code signing, trusted repositories, and vendor risk management.
• D. Attacks on physical hardware only; mitigations include tamper-evident seals.

Answer: (C)

A supply chain attack happens when an attacker compromises software or components during the delivery process, before they reach the end user, so normal products arrive with hidden malware or vulnerabilities. This is about trust in the sources and the build process, not just how a network is attacked or what happens after a device is in hand.

The mitigations listed are the right fit because they strengthen every link in that supply chain. An SBOM (Software Bill of Materials) gives a complete list of every component in a product, so you can spot risky or vulnerable pieces. Code signing ensures software is produced by a legitimate source and has not been altered in transit. Trusted repositories reduce the chance of pulling tampered components from unreliable sources. Vendor risk management addresses the broader supplier ecosystem, requiring security controls, monitoring, and contingency plans with third-party partners.

Options focusing on network traffic, post-delivery device compromise, or hardware tampering describe other kinds of attacks that don’t capture the essence of compromising software or components before delivery.