Which of the following statements about SBOM is most accurate?

• A. SBOM encrypts dependencies to prevent tampering.
• B. SBOM tracks license terms for each dependency.
• C. SBOM provides visibility into every component and dependency to assess risk and compliance.
• D. SBOM manages user access to dependencies.

Answer: (C)

SBOM centers on inventorying all components and dependencies in a piece of software so you know exactly what’s inside and where it came from. That visibility is what enables you to assess risk and compliance across the software supply chain. You can identify which open-source libraries and third-party components are included, check for known vulnerabilities, track licensing obligations, and verify provenance. Encrypting dependencies would hide information and defeat the purpose of visibility. While an SBOM may carry license information as part of its data, its main value is not simply tracking licenses but giving a complete view of components for risk and compliance. It also doesn’t handle who can access dependencies—that’s a separate access-control concern.