Learn vocabulary for Software Bill of Materials: components, licenses, vulnerabilities, and SBOM formats.
0 / 10 completed
1 / 10
What is an SBOM (Software Bill of Materials)?
SBOM (US Executive Order 14028 mandated for federal software): a structured list of all software components (direct and transitive dependencies), their versions, licenses, and supplier information. Enables: vulnerability management (which products are affected by CVE-X?), license compliance (are we using GPL code in a proprietary product?), and supply chain risk assessment.
2 / 10
What is the difference between 'SPDX' and 'CycloneDX' in SBOM vocabulary?
SPDX (Linux Foundation, ISO/IEC 5962): comprehensive standard covering licenses, copyrights, and component relationships. CycloneDX (OWASP): security-focused SBOM standard optimized for vulnerability management, integrations with CVE databases, and DevSecOps tooling. Many tools support both formats. US CISA recommends either.
3 / 10
What is a 'transitive dependency' in software supply chain vocabulary?
Transitive dependency risk: when Log4Shell (CVE-2021-44228) was disclosed, many organizations did not know they were vulnerable because Log4j was a transitive dependency — not something they directly imported. An SBOM reveals transitive dependencies, enabling rapid impact assessment when a new vulnerability is disclosed.
4 / 10
What is 'dependency confusion' in supply chain security vocabulary?
Dependency confusion attack (Alex Birsan, 2021): if your code depends on an internal package named company-auth, an attacker publishes a public package with the same name. Package managers that prefer public registries will download the malicious version. Mitigations: private package registry with scoped namespaces, dependency pinning, registry verification in CI.
5 / 10
What is 'software provenance' in supply chain security vocabulary?
Software provenance (SLSA Framework): 'who built this artifact, when, from which source commit, using which build platform?' Provenance attestations (signed metadata) allow consumers to verify the artifact they are running matches the source code they audited. Key for preventing the SolarWinds-type attack where build infrastructure was compromised.
6 / 10
Alice (Senior Developer) left this comment on a code review:
"I'm seeing a lot of JavaScript dependencies here. Could you generate an SBOM for this project to see exactly what we're pulling in? I want to understand the full supply chain risk."
This scenario tests understanding of SBOM's role in risk assessment. An SBOM provides a comprehensive list of all software components, allowing for proactive identification of vulnerabilities and potential supply chain issues. The comment highlights the importance of visibility – Alice is rightly concerned about external dependencies.
7 / 10
Ben (DevOps Engineer) sent this message in a Slack channel:
'Just ran `cyclonedx generate` on the frontend. The report shows several outdated versions of React and Lodash. We need to update our SBOM to reflect these changes and investigate potential security impacts.'
This focuses on practical usage. Ben is employing `cyclonedx generate` to create an SBOM – a standard practice for tracking dependencies. The message demonstrates the proactive use of SBOM data to address potential vulnerabilities and highlight outdated components requiring attention. It's a common workflow.
8 / 10
You are writing a PR description for a change that includes a new third-party library: `lodash`. The PR includes the following snippet:
```javascript
import _ from 'lodash';
```
What should you include in your SBOM to accurately represent this addition?
This assesses understanding of transitive dependencies. While `lodash` is directly imported, its own dependencies (e.g., core JavaScript libraries) are also part of the supply chain and must be included in the SBOM. Failing to account for these indirect dependencies creates a blind spot.
9 / 10
Chloe (Security Analyst) is reviewing an SBOM generated for a critical microservice and notices numerous vulnerabilities reported by the scanner. She identifies a transitive dependency on a component with known vulnerabilities. What term best describes this situation?
This directly tests understanding of 'dependency confusion'. This scenario accurately describes this common issue where a vulnerability in a transitive dependency is inadvertently introduced into the software supply chain due to misconfigured or unmanaged dependencies. Addressing this requires careful inventory and management practices.
10 / 10
During a standup meeting, David (Lead Developer) says: 'We're generating an SBOM to ensure we have visibility into all our dependencies and understand the software provenance for every component.' What is David primarily trying to achieve?
This question tests a broader understanding of SBOM's purpose. While SBOMs *can* be used for vulnerability management, David's statement focuses on 'software provenance' - tracking the origin and history of components. This is key to understanding the full context and potential risks associated with each dependency, which feeds into effective security practices.
What will I learn from the "SBOM — Software Bill of Materials Vocabulary" exercise?
Learn vocabulary for Software Bill of Materials: components, licenses, vulnerabilities, and SBOM formats.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall required.
How many questions are in this exercise?
This set contains 10 multiple-choice questions, each with a detailed explanation shown after you answer.
Do I need to create an account to track my progress?
No account is required. Your progress bar and score reset each time you reload the page, but you can retry the exercise as many times as you like.
Who is this Supply Chain Security exercise for?
This exercise is built for IT professionals and non-native English speakers who need to read, write, and discuss supply chain security topics confidently at work.
What happens if I answer a question incorrectly?
You will see the correct answer highlighted along with a detailed explanation of why it is correct -- so every wrong answer becomes a learning moment, not just a lost point.
Can I retry this exercise?
Yes -- click "Try again" on the results screen at any time to reset your score and go through all the questions again.
How long does this exercise take to complete?
Most learners finish all 10 questions in under 10 minutes, since each question is answered by clicking a single option.
Where can I find more Supply Chain Security exercises?
See the full Supply Chain Security exercises hub for more vocabulary drills on this topic.
Is this exercise mobile-friendly?
Yes -- the exercise works on any device with a modern browser, including phones and tablets, with no app download required.