What is the purpose of SBOM in software supply chain security?

• A. Lists components and licenses to identify vulnerabilities and verify provenance.
• B. Maps network routes for software deployment.
• C. Stores user credentials for applications.
• D. Serves as a replacement for source code reviews.

Answer: (A)

An SBOM provides a clear inventory of all software components and libraries in a product, including the licenses tied to each piece. This visibility lets security teams spot known vulnerabilities in those components and verify provenance—where each part came from and whether it’s from trusted sources. In software supply chain security, knowing exactly what’s inside the product and its licensing helps you assess risk, plan patches, and ensure compliance. It isn’t about mapping network routes, storing user credentials, or replacing code reviews. Those functions belong to other aspects of security, whereas the SBOM’s value lies in enumerating components and licenses to identify vulnerabilities and verify provenance.