Software supply chain risk management primarily focuses on?

• A. Physical security of data centers
• B. Managing risks from third-party software/components
• C. Network firewall configuration
• D. User access reviews

Answer: (B)

Software supply chain risk management centers on the risks that come from third-party software and components used to build and run applications. Modern software is built from a network of dependencies, libraries, open-source code, and vendor tools; if any of these external pieces are vulnerable or compromised, the whole product can be affected even if your own code is sound. The main goal is to protect the provenance, integrity, and security of those components through practices like maintaining a software bill of materials (SBOM), vetting suppliers, ongoing vulnerability scanning, timely patching, and secure software development processes. This focus helps prevent attacks that exploit weaknesses in third-party code, such as supply chain intrusions or unpatched libraries, from reaching end users.

The other options relate to different aspects of security. Physical security of data centers deals with protecting hardware and facilities, network firewall configuration focuses on controlling traffic at the network edge, and user access reviews are about managing who can access systems. While important, these do not capture the primary concern of software supply chain risk management, which is the security and trustworthiness of external software and components.