SBOM stands for Software Bill of Materials. What is its primary purpose in supply chain security?

• A. To enumerate software components and their licenses to assess risk and dependencies.
• B. To encrypt software binaries.
• C. To certify developers' qualifications.
• D. To replace vulnerability scanning.

Answer: (A)

SBOM's primary purpose is to enumerate software components and their licenses to assess risk and dependencies. This structured inventory reveals exactly what makes up a product, including third-party libraries and open-source code, their versions, and license terms. With that view, teams can identify components with known vulnerabilities, understand how components are related through dependencies, and verify license compliance, all of which strengthen supply chain security. This isn’t about encrypting binaries, certifying developers, or replacing vulnerability scanning—encryption protects data, developer qualifications belong to separate processes, and vulnerability scanning remains essential, with an SBOM making it easier to target and prioritize those scans.