Which two examples does NIST give of non-adversarial supply chain threats? Choose two.

Answer: A. Natural disaster
C. Legal or regulatory changes affecting supply, such as sanctions

SP 800-161r1 splits supply chain threats into adversarial ones such as malware insertion, counterfeits, espionage and supply disruption, and non-adversarial ones such as natural disaster, poor quality products, geopolitical events and legal or regulatory changes.

Source: NIST SP 800-161 Rev. 1 (NIST) — Sec. 2.2 Cybersecurity Risks Throughout Supply Chains