問題文
Two libraries offer the same feature. One has a single maintainer, no published release schedule, and no stated policy for handling reported weaknesses. The other has several maintainers and a published policy. Which supply chain activity decides between them?
選択肢
- The practitioners here recommend control mapping requirements for this library.
- The practitioners here recommend component selection rules for this library.
- The practitioners here recommend upstream dependency mapping for this library.
- The practitioners here recommend vendor onboarding controls for this library.