Which scenario demonstrates SBOM value for license compliance?

• A. Only when there are no licenses associated with components.
• B. When licenses are present and potential conflicts or violations exist.
• C. When there are no third-party components used.
• D. When only security vulnerabilities matter.

Answer: (B)

The main idea is that an SBOM proves its value for license compliance when licenses are actually present for the components, and there might be conflicts or obligations to manage. When you can see the licenses tied to each component, you can assess whether their terms are compatible with your product’s distribution, ensure obligations like attribution or source disclosure are met, and spot conflicts between licenses (for example, mixing a copyleft license with a permissive one that could impose incompatible requirements). That visibility and risk-prioritization is exactly what makes the SBOM useful for license compliance in this scenario. If licenses weren’t present, or there were no third-party components, or the focus was solely on security vulnerabilities, the SBOM wouldn’t demonstrate license compliance in the same way.