Which tool helps verify the integrity of vendor-supplied software?

• A. Penetration testing
• B. SBOM usage
• C. Data retention policy
• D. Secure erase

Answer: (B)

Knowing exactly what makes up a vendor’s software is essential to trust its integrity. An SBOM, or Software Bill of Materials, provides a complete inventory of every component, library, and dependency inside the product, including versions and licenses. With this visibility, you can confirm the software contains only approved components, verify that what you received matches the documented components, and check for known vulnerabilities or tampered components. This transparency lets you detect unexpected or unsafe additions before deployment and govern supply-chain risk more effectively. Penetration testing looks for security flaws in the system, not the component makeup; data retention policy governs how long data is kept; secure erase deals with removing data securely. So, using an SBOM is the best way to verify the integrity of vendor-supplied software.