# SEAS-8414 Chapter 9 Homework
## Blackboard Multiple-Choice Assessment: Supply Chain Integrity and Counterfeit Detection

**Use:** Due before the next Chapter 10 class session
**Total Points:** 100
**Format:** 50 single-correct-answer multiple choice questions, 2 points each
**Audience:** Doctoral students and senior cybersecurity practitioners

This assessment is designed for Blackboard delivery. Every item is multiple choice
with exactly one correct answer. The assessment is closed book: do not use the
textbook, notes, internet search, lab files, scanners, AI tools, or outside
incident writeups while answering.

Each question includes a scenario-provenance label. That label is a citation
trail for instructors and is never required to choose the answer. Every formula,
threshold, rule, or evidence contract required to answer appears inside the stem.

Chapter boundary: answer only within Chapter 9 supply-chain integrity, SBOM, provenance, and counterfeit analytics only. Do not import capabilities
from other chapters unless the stem explicitly defines them.

---

### Question 1

**Scenario provenance only (not needed to answer):** RFC 8446 TLS 1.3 standard.

A regional transit authority applies a five-signal counterfeit screen. The score is 0.25*MAC_OUI_mismatch + 0.30*firmware_hash_mismatch + 0.20*TCP_stack_mismatch + 0.15*entropy_anomaly + 0.10*timing_anomaly. Verdict is counterfeit-investigation for score >=0.70, inconclusive-review for 0.40-0.69, and no-counterfeit-escalation below 0.40. Signals are MAC=1, firmware=0, TCP=0, entropy=0, timing=0. Which result follows?

(a) 0.45; counterfeit-investigation
(b) 0.25; counterfeit-investigation
(c) 0.20; inconclusive-review
(d) 0.25; no-counterfeit-escalation
### Question 2

**Scenario provenance only (not needed to answer):** CISA AA21-042A on the 2021 U.S. water treatment facility compromise.

A water utility computes a vendor trust score. The stated formula is 0.30*CVE_density + 0.30*patch_response + 0.20*SBOM_quality + 0.20*provenance_quality. Grades are A>=90, B>=80, C>=70, D>=60, F<60. Scores are CVE=80, patch=50, SBOM=80, provenance=35. Which result follows?

(a) 62.0; grade A
(b) 67.2; grade C
(c) 62.0; grade D
(d) 61.2; grade C
### Question 3

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

A hospital medical-device network performs a Cyber Resilience Act screening with 13 controls. The rule is score = (passed + 0.5*partial) / 13 * 100. The device passes 7, partially satisfies 4, and fails 2. Which score follows?

(a) 30.8%
(b) 69.2%
(c) 53.8%
(d) 84.6%
### Question 4

**Scenario provenance only (not needed to answer):** MITRE ATT&CK for ICS public knowledge base.

A maritime port authority classifies provenance. The simplified Chapter 9 rule in this question is: L1 requires a scripted build; L2 requires hosted provenance; L3 requires hosted provenance from an isolated build platform with non-falsifiable provenance. Observed: scripted_build=True, hosted_provenance=True, isolated_builder=False, non_falsifiable_provenance=False. Which level follows?

(a) SLSA Build L2
(b) SLSA Build L3
(c) SLSA Build L1
(d) below SLSA Build L1
### Question 5

**Scenario provenance only (not needed to answer):** Mirai botnet public research by Antonakakis et al..

A smart-building operator checks firmware entropy. The rule is z = (observed_entropy - known_good_mean) / standard_deviation, and flag an anomaly when |z| > 3.0. Observed entropy is 9.2, known-good mean is 6.8, and standard deviation is 0.3. Which result follows?

(a) z=8.00; do not flag
(b) z=53.33; flag
(c) No determinate answer can be computed from the stated rule.
(d) z=8.00; flag
### Question 6

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A rail signaling operator estimates blast radius from a vulnerable firmware component. The self-contained rule is expected_affected_devices = devices_using_component * reachability_probability. 110 devices use the component and reachability probability is 0.50. Which expected count follows?

(a) No determinate answer can be computed from the stated rule.
(b) 110.0 devices
(c) 55.0 devices
(d) 110.5 devices
### Question 7

**Scenario provenance only (not needed to answer):** NIST Cybersecurity Framework 2.0.

A food processing plant compares two firmware images using function-hash Jaccard similarity. The rule is Jaccard = shared_hashes / union_hashes; same-lineage if Jaccard >= 0.72. shared_hashes=64, union_hashes=105. Which result follows?

(a) 0.379; different-lineage
(b) 0.610; different-lineage
(c) 1.641; same-lineage
(d) 0.610; same-lineage
### Question 8

**Scenario provenance only (not needed to answer):** CISA Known Exploited Vulnerabilities Catalog.

An airport baggage-handling network computes abandoned-component risk. The stated formula is risk = CVE_count*2 + (patch_lag_days/30)*3 + exposure_multiplier*4. CVE_count=5, patch_lag_days=20, exposure_multiplier=2.0. Which score follows?

(a) 20.0
(b) 27.0
(c) 12.0
(d) 78.0
### Question 9

**Scenario provenance only (not needed to answer):** Cui and Stolfo embedded device insecurity research.

A municipal camera program verifies in-toto-style attestations. The local rule is provenance_coverage = matched_artifacts / total_artifacts, and the gate passes only if coverage >=0.90. matched_artifacts=8, total_artifacts=8. Which result follows?

(a) No determinate answer can be computed from the stated rule.
(b) 1.000; fail
(c) 0.500; fail
(d) 1.000; pass
### Question 10

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

An electric cooperative parses an SBOM dependency DAG. The Chapter 9 rule in this question is: count unique vulnerable components, not duplicate dependency paths. The SBOM has 2 direct vulnerable components, 8 transitive vulnerable components, and 1 duplicate path mentions caused by a diamond dependency. Which unique vulnerable-component count follows?

(a) 2
(b) 8
(c) 10
(d) 11
### Question 11

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A chemical manufacturing site applies a five-signal counterfeit screen. The score is 0.25*MAC_OUI_mismatch + 0.30*firmware_hash_mismatch + 0.20*TCP_stack_mismatch + 0.15*entropy_anomaly + 0.10*timing_anomaly. Verdict is counterfeit-investigation for score >=0.70, inconclusive-review for 0.40-0.69, and no-counterfeit-escalation below 0.40. Signals are MAC=1, firmware=1, TCP=1, entropy=0, timing=0. Which result follows?

(a) 0.60; inconclusive-review
(b) 0.75; counterfeit-investigation
(c) 0.95; counterfeit-investigation
(d) 0.75; no-counterfeit-escalation
### Question 12

**Scenario provenance only (not needed to answer):** MITRE ATT&CK public knowledge base.

A university building-automation program computes a vendor trust score. The stated formula is 0.30*CVE_density + 0.30*patch_response + 0.20*SBOM_quality + 0.20*provenance_quality. Grades are A>=90, B>=80, C>=70, D>=60, F<60. Scores are CVE=70, patch=30, SBOM=80, provenance=35. Which result follows?

(a) 53.0; grade F
(b) 53.8; grade C
(c) 53.0; grade A
(d) 58.2; grade C
### Question 13

**Scenario provenance only (not needed to answer):** RFC 8446 TLS 1.3 standard.

A regional transit authority performs a Cyber Resilience Act screening with 13 controls. The rule is score = (passed + 0.5*partial) / 13 * 100. The device passes 5, partially satisfies 4, and fails 4. Which score follows?

(a) 38.5%
(b) 69.2%
(c) 46.2%
(d) 53.8%
### Question 14

**Scenario provenance only (not needed to answer):** CISA AA21-042A on the 2021 U.S. water treatment facility compromise.

A water utility classifies provenance. The simplified Chapter 9 rule in this question is: L1 requires a scripted build; L2 requires hosted provenance; L3 requires hosted provenance from an isolated build platform with non-falsifiable provenance. Observed: scripted_build=True, hosted_provenance=False, isolated_builder=True, non_falsifiable_provenance=False. Which level follows?

(a) No determinate answer can be computed from the stated rule.
(b) below SLSA Build L1
(c) SLSA Build L1
(d) SLSA Build L3
### Question 15

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

A hospital medical-device network checks firmware entropy. The rule is z = (observed_entropy - known_good_mean) / standard_deviation, and flag an anomaly when |z| > 3.0. Observed entropy is 8.4, known-good mean is 6.8, and standard deviation is 0.3. Which result follows?

(a) No determinate answer can be computed from the stated rule.
(b) z=5.33; flag
(c) z=5.33; do not flag
(d) z=50.67; flag
### Question 16

**Scenario provenance only (not needed to answer):** MITRE ATT&CK for ICS public knowledge base.

A maritime port authority estimates blast radius from a vulnerable firmware component. The self-contained rule is expected_affected_devices = devices_using_component * reachability_probability. 50 devices use the component and reachability probability is 0.20. Which expected count follows?

(a) 10.0 devices
(b) 50.2 devices
(c) 40.0 devices
(d) 50.0 devices
### Question 17

**Scenario provenance only (not needed to answer):** Mirai botnet public research by Antonakakis et al..

A smart-building operator compares two firmware images using function-hash Jaccard similarity. The rule is Jaccard = shared_hashes / union_hashes; same-lineage if Jaccard >= 0.72. shared_hashes=40, union_hashes=84. Which result follows?

(a) 2.100; same-lineage
(b) 0.476; same-lineage
(c) 0.323; different-lineage
(d) 0.476; different-lineage
### Question 18

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A rail signaling operator computes abandoned-component risk. The stated formula is risk = CVE_count*2 + (patch_lag_days/30)*3 + exposure_multiplier*4. CVE_count=3, patch_lag_days=50, exposure_multiplier=1.0. Which score follows?

(a) 11.0
(b) 160.0
(c) 15.0
(d) 54.0
### Question 19

**Scenario provenance only (not needed to answer):** NIST Cybersecurity Framework 2.0.

A food processing plant verifies in-toto-style attestations. The local rule is provenance_coverage = matched_artifacts / total_artifacts, and the gate passes only if coverage >=0.90. matched_artifacts=7, total_artifacts=8. Which result follows?

(a) 0.467; fail
(b) 0.875; fail
(c) 1.143; pass
(d) 0.875; pass
### Question 20

**Scenario provenance only (not needed to answer):** CISA Known Exploited Vulnerabilities Catalog.

An airport baggage-handling network parses an SBOM dependency DAG. The Chapter 9 rule in this question is: count unique vulnerable components, not duplicate dependency paths. The SBOM has 2 direct vulnerable components, 11 transitive vulnerable components, and 1 duplicate path mentions caused by a diamond dependency. Which unique vulnerable-component count follows?

(a) 13
(b) 14
(c) 2
(d) 11
### Question 21

**Scenario provenance only (not needed to answer):** Cui and Stolfo embedded device insecurity research.

A municipal camera program applies a five-signal counterfeit screen. The score is 0.25*MAC_OUI_mismatch + 0.30*firmware_hash_mismatch + 0.20*TCP_stack_mismatch + 0.15*entropy_anomaly + 0.10*timing_anomaly. Verdict is counterfeit-investigation for score >=0.70, inconclusive-review for 0.40-0.69, and no-counterfeit-escalation below 0.40. Signals are MAC=1, firmware=0, TCP=1, entropy=1, timing=0. Which result follows?

(a) 0.80; counterfeit-investigation
(b) 0.60; no-counterfeit-escalation
(c) No determinate answer can be computed from the stated rule.
(d) 0.60; inconclusive-review
### Question 22

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

An electric cooperative computes a vendor trust score. The stated formula is 0.30*CVE_density + 0.30*patch_response + 0.20*SBOM_quality + 0.20*provenance_quality. Grades are A>=90, B>=80, C>=70, D>=60, F<60. Scores are CVE=80, patch=70, SBOM=80, provenance=35. Which result follows?

(a) 68.0; grade A
(b) 71.2; grade C
(c) 68.0; grade D
(d) 66.2; grade C
### Question 23

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A chemical manufacturing site performs a Cyber Resilience Act screening with 13 controls. The rule is score = (passed + 0.5*partial) / 13 * 100. The device passes 9, partially satisfies 4, and fails 0. Which score follows?

(a) 15.4%
(b) 84.6%
(c) 69.2%
(d) 100.0%
### Question 24

**Scenario provenance only (not needed to answer):** MITRE ATT&CK public knowledge base.

A university building-automation program classifies provenance. The simplified Chapter 9 rule in this question is: L1 requires a scripted build; L2 requires hosted provenance; L3 requires hosted provenance from an isolated build platform with non-falsifiable provenance. Observed: scripted_build=True, hosted_provenance=True, isolated_builder=True, non_falsifiable_provenance=True. Which level follows?

(a) SLSA Build L3
(b) SLSA Build L2
(c) SLSA Build L1
(d) below SLSA Build L1
### Question 25

**Scenario provenance only (not needed to answer):** RFC 8446 TLS 1.3 standard.

A regional transit authority checks firmware entropy. The rule is z = (observed_entropy - known_good_mean) / standard_deviation, and flag an anomaly when |z| > 3.0. Observed entropy is 7.6, known-good mean is 6.8, and standard deviation is 0.3. Which result follows?

(a) z=2.67; flag
(b) z=48.00; flag
(c) No determinate answer can be computed from the stated rule.
(d) z=2.67; do not flag
### Question 26

**Scenario provenance only (not needed to answer):** CISA AA21-042A on the 2021 U.S. water treatment facility compromise.

A water utility estimates blast radius from a vulnerable firmware component. The self-contained rule is expected_affected_devices = devices_using_component * reachability_probability. 95 devices use the component and reachability probability is 0.50. Which expected count follows?

(a) No determinate answer can be computed from the stated rule.
(b) 95.0 devices
(c) 47.5 devices
(d) 95.5 devices
### Question 27

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

A hospital medical-device network compares two firmware images using function-hash Jaccard similarity. The rule is Jaccard = shared_hashes / union_hashes; same-lineage if Jaccard >= 0.72. shared_hashes=48, union_hashes=68. Which result follows?

(a) 0.414; different-lineage
(b) 0.706; different-lineage
(c) 1.417; same-lineage
(d) 0.706; same-lineage
### Question 28

**Scenario provenance only (not needed to answer):** MITRE ATT&CK for ICS public knowledge base.

A maritime port authority computes abandoned-component risk. The stated formula is risk = CVE_count*2 + (patch_lag_days/30)*3 + exposure_multiplier*4. CVE_count=7, patch_lag_days=80, exposure_multiplier=1.5. Which score follows?

(a) 28.0
(b) 88.5
(c) 22.0
(d) 260.0
### Question 29

**Scenario provenance only (not needed to answer):** Mirai botnet public research by Antonakakis et al..

A smart-building operator verifies in-toto-style attestations. The local rule is provenance_coverage = matched_artifacts / total_artifacts, and the gate passes only if coverage >=0.90. matched_artifacts=6, total_artifacts=8. Which result follows?

(a) 1.333; pass
(b) 0.750; pass
(c) 0.429; fail
(d) 0.750; fail
### Question 30

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A rail signaling operator parses an SBOM dependency DAG. The Chapter 9 rule in this question is: count unique vulnerable components, not duplicate dependency paths. The SBOM has 2 direct vulnerable components, 7 transitive vulnerable components, and 1 duplicate path mentions caused by a diamond dependency. Which unique vulnerable-component count follows?

(a) 2
(b) 7
(c) 9
(d) 10
### Question 31

**Scenario provenance only (not needed to answer):** NIST Cybersecurity Framework 2.0.

A food processing plant applies a five-signal counterfeit screen. The score is 0.25*MAC_OUI_mismatch + 0.30*firmware_hash_mismatch + 0.20*TCP_stack_mismatch + 0.15*entropy_anomaly + 0.10*timing_anomaly. Verdict is counterfeit-investigation for score >=0.70, inconclusive-review for 0.40-0.69, and no-counterfeit-escalation below 0.40. Signals are MAC=1, firmware=1, TCP=0, entropy=1, timing=0. Which result follows?

(a) 0.60; inconclusive-review
(b) 0.70; counterfeit-investigation
(c) 0.90; counterfeit-investigation
(d) 0.70; no-counterfeit-escalation
### Question 32

**Scenario provenance only (not needed to answer):** CISA Known Exploited Vulnerabilities Catalog.

An airport baggage-handling network computes a vendor trust score. The stated formula is 0.30*CVE_density + 0.30*patch_response + 0.20*SBOM_quality + 0.20*provenance_quality. Grades are A>=90, B>=80, C>=70, D>=60, F<60. Scores are CVE=70, patch=50, SBOM=80, provenance=35. Which result follows?

(a) 59.0; grade F
(b) 58.8; grade C
(c) 59.0; grade A
(d) 62.2; grade C
### Question 33

**Scenario provenance only (not needed to answer):** Cui and Stolfo embedded device insecurity research.

A municipal camera program performs a Cyber Resilience Act screening with 13 controls. The rule is score = (passed + 0.5*partial) / 13 * 100. The device passes 7, partially satisfies 4, and fails 2. Which score follows?

(a) 53.8%
(b) 84.6%
(c) 30.8%
(d) 69.2%
### Question 34

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

An electric cooperative classifies provenance. The simplified Chapter 9 rule in this question is: L1 requires a scripted build; L2 requires hosted provenance; L3 requires hosted provenance from an isolated build platform with non-falsifiable provenance. Observed: scripted_build=True, hosted_provenance=False, isolated_builder=False, non_falsifiable_provenance=True. Which level follows?

(a) No determinate answer can be computed from the stated rule.
(b) below SLSA Build L1
(c) SLSA Build L1
(d) SLSA Build L3
### Question 35

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A chemical manufacturing site checks firmware entropy. The rule is z = (observed_entropy - known_good_mean) / standard_deviation, and flag an anomaly when |z| > 3.0. Observed entropy is 9.2, known-good mean is 6.8, and standard deviation is 0.3. Which result follows?

(a) No determinate answer can be computed from the stated rule.
(b) z=8.00; flag
(c) z=8.00; do not flag
(d) z=53.33; flag
### Question 36

**Scenario provenance only (not needed to answer):** MITRE ATT&CK public knowledge base.

A university building-automation program estimates blast radius from a vulnerable firmware component. The self-contained rule is expected_affected_devices = devices_using_component * reachability_probability. 35 devices use the component and reachability probability is 0.20. Which expected count follows?

(a) 7.0 devices
(b) 35.2 devices
(c) 28.0 devices
(d) 35.0 devices
### Question 37

**Scenario provenance only (not needed to answer):** RFC 8446 TLS 1.3 standard.

A regional transit authority compares two firmware images using function-hash Jaccard similarity. The rule is Jaccard = shared_hashes / union_hashes; same-lineage if Jaccard >= 0.72. shared_hashes=56, union_hashes=79. Which result follows?

(a) 1.411; same-lineage
(b) 0.709; same-lineage
(c) 0.415; different-lineage
(d) 0.709; different-lineage
### Question 38

**Scenario provenance only (not needed to answer):** CISA AA21-042A on the 2021 U.S. water treatment facility compromise.

A water utility computes abandoned-component risk. The stated formula is risk = CVE_count*2 + (patch_lag_days/30)*3 + exposure_multiplier*4. CVE_count=5, patch_lag_days=110, exposure_multiplier=2.0. Which score follows?

(a) 21.0
(b) 348.0
(c) 29.0
(d) 117.0
### Question 39

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

A hospital medical-device network verifies in-toto-style attestations. The local rule is provenance_coverage = matched_artifacts / total_artifacts, and the gate passes only if coverage >=0.90. matched_artifacts=8, total_artifacts=8. Which result follows?

(a) 0.500; fail
(b) 1.000; pass
(c) No determinate answer can be computed from the stated rule.
(d) 1.000; fail
### Question 40

**Scenario provenance only (not needed to answer):** MITRE ATT&CK for ICS public knowledge base.

A maritime port authority parses an SBOM dependency DAG. The Chapter 9 rule in this question is: count unique vulnerable components, not duplicate dependency paths. The SBOM has 2 direct vulnerable components, 10 transitive vulnerable components, and 1 duplicate path mentions caused by a diamond dependency. Which unique vulnerable-component count follows?

(a) 12
(b) 13
(c) 2
(d) 10
### Question 41

**Scenario provenance only (not needed to answer):** Mirai botnet public research by Antonakakis et al..

A smart-building operator applies a five-signal counterfeit screen. The score is 0.25*MAC_OUI_mismatch + 0.30*firmware_hash_mismatch + 0.20*TCP_stack_mismatch + 0.15*entropy_anomaly + 0.10*timing_anomaly. Verdict is counterfeit-investigation for score >=0.70, inconclusive-review for 0.40-0.69, and no-counterfeit-escalation below 0.40. Signals are MAC=1, firmware=0, TCP=1, entropy=0, timing=0. Which result follows?

(a) 0.65; counterfeit-investigation
(b) 0.45; no-counterfeit-escalation
(c) 0.40; inconclusive-review
(d) 0.45; inconclusive-review
### Question 42

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A rail signaling operator computes a vendor trust score. The stated formula is 0.30*CVE_density + 0.30*patch_response + 0.20*SBOM_quality + 0.20*provenance_quality. Grades are A>=90, B>=80, C>=70, D>=60, F<60. Scores are CVE=80, patch=30, SBOM=80, provenance=35. Which result follows?

(a) 56.0; grade A
(b) 63.2; grade C
(c) 56.0; grade F
(d) 56.2; grade C
### Question 43

**Scenario provenance only (not needed to answer):** NIST Cybersecurity Framework 2.0.

A food processing plant performs a Cyber Resilience Act screening with 13 controls. The rule is score = (passed + 0.5*partial) / 13 * 100. The device passes 5, partially satisfies 4, and fails 4. Which score follows?

(a) 46.2%
(b) 53.8%
(c) 38.5%
(d) 69.2%
### Question 44

**Scenario provenance only (not needed to answer):** CISA Known Exploited Vulnerabilities Catalog.

An airport baggage-handling network classifies provenance. The simplified Chapter 9 rule in this question is: L1 requires a scripted build; L2 requires hosted provenance; L3 requires hosted provenance from an isolated build platform with non-falsifiable provenance. Observed: scripted_build=True, hosted_provenance=True, isolated_builder=True, non_falsifiable_provenance=False. Which level follows?

(a) SLSA Build L2
(b) SLSA Build L3
(c) SLSA Build L1
(d) below SLSA Build L1
### Question 45

**Scenario provenance only (not needed to answer):** Cui and Stolfo embedded device insecurity research.

A municipal camera program checks firmware entropy. The rule is z = (observed_entropy - known_good_mean) / standard_deviation, and flag an anomaly when |z| > 3.0. Observed entropy is 8.4, known-good mean is 6.8, and standard deviation is 0.3. Which result follows?

(a) z=5.33; do not flag
(b) z=50.67; flag
(c) No determinate answer can be computed from the stated rule.
(d) z=5.33; flag
### Question 46

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

An electric cooperative estimates blast radius from a vulnerable firmware component. The self-contained rule is expected_affected_devices = devices_using_component * reachability_probability. 80 devices use the component and reachability probability is 0.50. Which expected count follows?

(a) No determinate answer can be computed from the stated rule.
(b) 80.0 devices
(c) 40.0 devices
(d) 80.5 devices
### Question 47

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A chemical manufacturing site compares two firmware images using function-hash Jaccard similarity. The rule is Jaccard = shared_hashes / union_hashes; same-lineage if Jaccard >= 0.72. shared_hashes=64, union_hashes=90. Which result follows?

(a) 0.416; different-lineage
(b) 0.711; different-lineage
(c) 1.406; same-lineage
(d) 0.711; same-lineage
### Question 48

**Scenario provenance only (not needed to answer):** MITRE ATT&CK public knowledge base.

A university building-automation program computes abandoned-component risk. The stated formula is risk = CVE_count*2 + (patch_lag_days/30)*3 + exposure_multiplier*4. CVE_count=3, patch_lag_days=20, exposure_multiplier=1.0. Which score follows?

(a) 12.0
(b) 24.0
(c) 8.0
(d) 70.0
### Question 49

**Scenario provenance only (not needed to answer):** RFC 8446 TLS 1.3 standard.

A regional transit authority verifies in-toto-style attestations. The local rule is provenance_coverage = matched_artifacts / total_artifacts, and the gate passes only if coverage >=0.90. matched_artifacts=7, total_artifacts=8. Which result follows?

(a) 1.143; pass
(b) 0.875; pass
(c) 0.467; fail
(d) 0.875; fail
### Question 50

**Scenario provenance only (not needed to answer):** CISA AA21-042A on the 2021 U.S. water treatment facility compromise.

A water utility parses an SBOM dependency DAG. The Chapter 9 rule in this question is: count unique vulnerable components, not duplicate dependency paths. The SBOM has 2 direct vulnerable components, 6 transitive vulnerable components, and 1 duplicate path mentions caused by a diamond dependency. Which unique vulnerable-component count follows?

(a) 2
(b) 6
(c) 8
(d) 9
