CISA Practice Test

CISA practice test: what's covered

• CISA 2025 SBOM Elements
• VEX
• OWASP SCVS
• Supplier Evidence

Free CISA sample questions

1. A vendor sends a spreadsheet listing only top-level open source libraries for a SaaS product. Your procurement team needs evidence aligned to modern SBOM expectations. What is the BEST response?

   • A. Request a machine-readable SBOM that includes direct and transitive components, versions, suppliers and dependency relationships
   • B. Accept the spreadsheet because manually typed library names are easier for executives to read
   • C. Ask the vendor to remove transitive dependencies so the document stays short enough for email
   • D. Approve the product if the vendor promises that no vulnerable packages are intentionally used
   Show answer

   Correct: A. A useful SBOM should support software transparency and risk management by identifying the components and relationships that make up the product, including transitive dependency exposure. A manually typed top-level list is not enough for automated vulnerability matching, supplier review or change tracking, while promises without artifact evidence do not support repeatable assurance.

2. An engineering team generates an SBOM from a source repository before the production image is built. Later, the container build installs additional OS packages. Which action best closes the evidence gap?

   • A. Generate or attach an SBOM for the final release artifact digest after the build completes
   • B. Keep only the source repository SBOM because it proves developer intent
   • C. Disable OS package installation so scanners cannot see package names
   • D. Replace the release artifact digest with the latest tag in every evidence record
   Show answer

   Correct: A. The reviewed artifact should match what is actually shipped. If build steps add packages, a pre-build source SBOM alone can miss runtime components. Tying the SBOM to the immutable release artifact digest gives security, operations and customers evidence that can be matched to vulnerability data and repeated during audits.

3. A security lead is defining minimum acceptance criteria for supplier SBOMs. Which TWO requirements best improve operational usefulness? (Choose TWO)

   • A. Include unique component identifiers such as package URL, CPE or supplier-specific identifiers where appropriate
   • B. Capture dependency relationships so analysts can understand parent and transitive exposure
   • C. Allow suppliers to hide component versions because attackers might read them
   • D. Store the SBOM only as a screenshot inside a project status slide
   • E. Require every component name to be rewritten into the customer's internal naming style
   Show answer

   Correct: A and B. Identifiers and dependency relationships make an SBOM useful for matching vulnerabilities, deduplicating components and tracing affected paths. Hiding versions, using screenshots or rewriting names weakens machine processing and creates ambiguity when teams need to respond quickly to a new CVE or supplier advisory.

4. A regulator asks whether the organization can reproduce the SBOM used for a release six months ago. Which evidence is most defensible?

   • A. A signed release record containing the artifact digest, SBOM file, generator tool/version, timestamp and build pipeline run
   • B. A developer's statement that the dependency list probably has not changed much since release
   • C. The current package-lock file from main branch regardless of which commit was released
   • D. A ticket comment saying the team will regenerate an approximate SBOM if someone asks
   Show answer

   Correct: A. Reproducibility depends on preserving the exact artifact identity and generation context. A release record with digest, SBOM, tool/version, timestamp and pipeline run lets an auditor connect the inventory to the shipped software. Current branch files or informal recollection cannot prove what was delivered at the time.

5. A vulnerability scanner flags a CVE in a library included in a vendor appliance. The vendor publishes a VEX statement saying the vulnerable function is not present in the compiled product. What should the customer do next?

   • A. Review the VEX status, justification, product/version scope and evidence before reducing remediation priority
   • B. Delete the finding permanently because all VEX statements are always complete and current
   • C. Patch every instance immediately without considering reachability or product scope
   • D. Ignore the vendor's statement because SBOM data alone is the only acceptable vulnerability evidence
   Show answer

   Correct: A. VEX is designed to communicate whether a known vulnerability affects a specific product, but it still needs scope, status, justification and evidence review. A sound triage process can lower priority when non-affected evidence is credible, while blindly deleting findings or ignoring exploitability context both create avoidable risk.

Last updated: 2026-10-19

CISA practice test FAQ