Software bill of materials (SBOM)

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. What does an SBOM list?

A Every component and library inside a piece of software

B Only the passwords used by the software's developers

2. Why does an SBOM include version numbers?

A So the software looks more professional to customers

B So each component can be checked against known vulnerabilities for that version

3. A library in your SBOM is listed as 'imagekit 2.1'. A vulnerability report says 'imagekit 2.1 can be hacked'. What should you do?

A Check for a patched version and update the component

B Ignore the report because the library is not your own code

4. Which one is a good example of what an SBOM records?

A logging-lib, version 1.4.2

B The name of the programmer who was working late

5. A new vulnerability is announced in a popular library. How does an SBOM help?

A It automatically stops attackers from reaching your network

B You can quickly search the list to see if your software uses that library

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1SBOM		Anumpy 1.16.0 -> check for known flaws
2requests==2.19.0		BThe SBOM has no version numbers, so nobody can tell whether the versions used have known vulnerabilities. Add versions such as flask 2.0.1.
3An SBOM is a component list, so each library inside the software is named		CA software bill of materials: a list of every component and library inside a piece of software
4An SBOM records version numbers so a component can be checked for known vulnerabilities		DThe SBOM lists only one component. It must list every component and library inside the software, including the ones it depends on.
5SBOM: flask, numpy, pillow		Ecomponents: ["flask", "jinja2", "numpy"]
6SBOM: flask 2.0.1 (only the main app, no libraries)		FA component name with its exact version number, as it would appear in an SBOM entry

Definitions

SBOM

Fill in the Blanks

Complete each line of code by filling in the missing parts.

{"name": "my-app", "__________": [ {"name": "flask"}]}

{"name": "requests", "_______": "2.31.0"}

{"____": "flask", "version": "3.0.0"}

sbom = ["flask 3.0.0", "numpy 1.26.4"] for item in ____: print(item)

bad = {"log4j": "2.14.1"} if component __ bad: print("Update needed!")

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A sbom = [

B "flask": "2.3.2",

C "requests": "2.31.0"

D }

Question 2

A sbom = {

B "flask": "2.3.2",

C "requests" "2.31.0"

D }

Question 3

A sbom = {"flask": "2.3.2"}

B for name in sbom

C print(name, sbom[name])

Question 4

A sbom = {"flask": "2.3.2"}

B version = sbom[flask]

C print("flask", version)

Question 5

A sbom = {"flask": "2.3.2"}

B bad = "2.3.2"

C if sbom["flask"] = bad:

D print("Vulnerable")

Answer Key

Software bill of materials (SBOM)

Section A: Quick Questions

A — Every component and library inside a piece of software

B — So each component can be checked against known vulnerabilities for that version

A — Check for a patched version and update the component

A — logging-lib, version 1.4.2

B — You can quickly search the list to see if your software uses that library

Section B: Match the Pairs

SBOM → A software bill of materials: a list of every component and library inside a piece of software

requests==2.19.0 → A component name with its exact version number, as it would appear in an SBOM entry

An SBOM is a component list, so each library inside the software is named → components: ["flask", "jinja2", "numpy"]

An SBOM records version numbers so a component can be checked for known vulnerabilities → numpy 1.16.0 -> check for known flaws

SBOM: flask, numpy, pillow → The SBOM has no version numbers, so nobody can tell whether the versions used have known vulnerabilities. Add versions such as flask 2.0.1.

SBOM: flask 2.0.1 (only the main app, no libraries) → The SBOM lists only one component. It must list every component and library inside the software, including the ones it depends on.

Section C: Definitions

SBOM — A software bill of materials: a list of every component and library inside software, with version numbers, so each can be checked for known vulnerabilities.

Section D: Fill in the Blanks

{"name": "my-app",
 "components": [
  {"name": "flask"}]}

{"name": "requests", "version": "2.31.0"}

{"name": "flask", "version": "3.0.0"}

sbom = ["flask 3.0.0", "numpy 1.26.4"]
for item in sbom:
    print(item)

bad = {"log4j": "2.14.1"}
if component in bad:
    print("Update needed!")

Section E: Spot the Error

A — The SBOM component list is a dictionary of name and version pairs, so it must open with { to match the closing }. It should be sbom = {.

C — Each component needs a colon between its name and its version number. It should be "requests": "2.31.0".

B — A for loop line must end with a colon. Without it, the loop that lists each SBOM component will not run. It should be for name in sbom:.

B — The component name is a string key, so it needs quotes. Without them Python looks for a variable called flask. It should be sbom["flask"].

C — A single = assigns a value, but an if needs a comparison. To check whether the version in the SBOM matches the known vulnerable version, use ==.