Software Supply Chain Security GCSA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a common software supply chain attack vector that targets the mechanism used to deliver software to end users?

   • AIntercepting and altering a software update as it is downloaded from a vendor's CDN
   • BExploiting a vulnerability in a build server's operating system to gain control of the build process
   • CSubstituting a malicious package in a public repository that is then pulled by developers
   • DCompromising a developer's IDE plugin to inject malicious code during local builds
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A software vendor wants to achieve SLSA Level 3 for its build process. They currently have a hosted CI/CD service that generates provenance, but the provenance is not signed and the build environment is not isolated per build. They also use a mix of third-party build tools that are not pinned to specific versions. Which set of changes is required to meet SLSA Level 3?

   • AIncrease the frequency of builds to reduce the window for tampering.
   • BSign the provenance with the build service's key, run each build in an isolated environment, and pin all build tools to specific versions.
   • CAdd a manual review step to the pipeline and generate an SBOM for each artifact.
   • DUse a private artifact registry to store all build tools and dependencies.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst is investigating a supply chain incident where a malicious package was published to a public registry under a name very similar to a popular legitimate package (typosquatting). A developer in the company accidentally used the malicious package. Which attack vector does this represent?

   • ACompromised distribution mechanism via a hacked registry.
   • BCompromised source code via a malicious commit.
   • CCompromised build tool via a malicious plugin.
   • DCompromised dependency via a typosquatted package name.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which framework is published by NIST to help organizations develop secure software?

   • AOWASP ASVS
   • BNIST SSDF
   • CSLSA
   • DISO 27001
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A large organization is adopting SLSA to improve supply chain security. They currently have a CI/CD pipeline that runs builds on shared, long-lived agents with admin access to the artifact repository. The team wants to achieve SLSA Level 2 for their most critical application. Which set of changes is both necessary and sufficient to meet SLSA Level 2 requirements?

   • ARun a nightly vulnerability scan on all dependencies and generate an SBOM for each release.
   • BAdd a code review step for all changes and require two-factor authentication for developers.
   • CUse a dedicated build environment that is isolated from other builds, run builds with least-privilege credentials, and generate signed provenance attestations for each build.
   • DMove the artifact repository to a different cloud provider and enable encryption at rest.
   Reveal Solution Discussion Select an answer first