A company wants to generate and verify provenance for its software artifacts to meet SLSA Level 2. The build runs on a hosted CI/CD service. Select all that apply.

Generate provenance metadata that includes the build environment, build command, and source repository commit.

Store the provenance alongside the artifact in the artifact registry.

Use a developer's personal signing key to sign the provenance.

Sign the provenance with the build service's private key.

A company discovers that a malicious package was published to their internal package registry and was used as a dependency in several applications. The malicious package has been removed from the registry, but the company needs to ensure that no application is still running with the compromised code. Which combination of actions should the incident response team take?

Block the package name in the firewall and update the registry's access controls.

Run a memory scan on all production servers to detect the malicious package's signature.

Identify all applications that depend on the malicious package using SBOMs, then redeploy those applications from known-good builds after verifying the integrity of the build artifacts.

Roll back the package registry to a backup from before the malicious package was published.

What is the primary purpose of provenance metadata in a software supply chain?

To encrypt the artifact for secure distribution

To provide a list of all known vulnerabilities in the artifact

To replace the need for digital signatures

To document the origin and build process of an artifact

A developer downloads a third-party library directly from a website using HTTPS. The website provides a SHA-256 checksum on the download page. The developer wants to ensure the file has not been tampered with during download. Which step should the developer take?

Open the file in a text editor and check for suspicious strings.

Upload the file to VirusTotal and wait for the scan results.

Verify the website's TLS certificate and check that the URL uses HTTPS.

Compute the SHA-256 hash of the downloaded file and compare it to the checksum provided on the website.

When downloading a container image, what does verifying its cryptographic hash ensure?

The image is from an official vendor

The image will run without errors

The image is free of known vulnerabilities

The image has not been tampered with during download

GIAC Cloud Security Automation

Domain 5Objective 3

Software Supply Chain Security GCSA Practice Questions (Page 10)

Part of the Identity, Secrets, and Supply Chain domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

8concepts

Questions 46–50

46application · medium · select all that apply
A company wants to generate and verify provenance for its software artifacts to meet SLSA Level 2. The build runs on a hosted CI/CD service. Select all that apply.
Select an answer first
47expert · hard
A company discovers that a malicious package was published to their internal package registry and was used as a dependency in several applications. The malicious package has been removed from the registry, but the company needs to ensure that no application is still running with the compromised code. Which combination of actions should the incident response team take?
Select an answer first
48foundation · easy
What is the primary purpose of provenance metadata in a software supply chain?
Select an answer first
49application · medium
A developer downloads a third-party library directly from a website using HTTPS. The website provides a SHA-256 checksum on the download page. The developer wants to ensure the file has not been tampered with during download. Which step should the developer take?
Select an answer first
50foundation · easy
When downloading a container image, what does verifying its cryptographic hash ensure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.