Tools designed to assist with identification of third-party and open-source code during software development and deployment.

Tools designed to assist with identification of third-party and open-source code during software development and deployment.

• A. software bill of materials (SBOM)
• B. software composition analysis (SCA)
• C. threat feeds
• D. Reputational threat intelligence

Answer: (B)

Identifying third-party and open-source code used in software during development and deployment is all about inventorying components, including what they are, which versions are in use, and what licenses or vulnerabilities they bring. The tool category that does this most directly is Software Composition Analysis (SCA). SCA tools scan your codebases, package manifests, and build artifacts to enumerate every open-source and third-party component, map each to its version, identify license obligations, and check for known security vulnerabilities. This gives teams a clear view of the software’s supply chain so they can manage licensing risks, track dependencies, and prioritize remediation. An SBOM—the bill of materials—is a structured list of components that can be produced from this analysis, but the core function you’re focused on is the analysis and discovery itself—what components exist and what risks they carry. The other options—threat feeds and reputational threat intelligence—deal with external threat information unrelated to identifying or inventorying software components.

Identifying third-party and open-source code used in software during development and deployment is all about inventorying components, including what they are, which versions are in use, and what licenses or vulnerabilities they bring. The tool category that does this most directly is Software Composition Analysis (SCA). SCA tools scan your codebases, package manifests, and build artifacts to enumerate every open-source and third-party component, map each to its version, identify license obligations, and check for known security vulnerabilities. This gives teams a clear view of the software’s supply chain so they can manage licensing risks, track dependencies, and prioritize remediation.

An SBOM—the bill of materials—is a structured list of components that can be produced from this analysis, but the core function you’re focused on is the analysis and discovery itself—what components exist and what risks they carry. The other options—threat feeds and reputational threat intelligence—deal with external threat information unrelated to identifying or inventorying software components.