Software Supply Chain Security GCSA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of a dependency lock file in a software project?

   • ATo prevent developers from adding new dependencies
   • BTo store the cryptographic hashes of all transitive dependencies
   • CTo list the licenses of all dependencies
   • DTo record the exact versions of all direct and transitive dependencies
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security engineer must verify that a container image deployed to production was built by the organization's CI/CD pipeline and has not been altered since it was built. The pipeline signs images with a private key, and the public key is stored in a key management service. Which verification steps should the engineer perform?

   • ACheck that the image is listed in the organization's SBOM and that the SBOM is signed by the development team.
   • BVerify the image's digital signature using the public key and confirm that the signature was generated by the CI/CD pipeline's signing key.
   • CUse the public key to decrypt the image layers and compare them to the source code in the repository.
   • DCompare the image's SHA-256 hash to the hash stored in the container registry's metadata.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company is implementing NIST SSDF and wants to ensure that its build pipeline is reproducible. They currently use a build server that has been manually configured over time, and the build process depends on system-wide installed tools. The team wants to make the build reproducible without a major overhaul. Which approach best achieves reproducibility?

   • ADocument the build steps in a README file and require developers to follow them manually.
   • BUse a container image with pinned versions of all build tools and dependencies, and store the image in a private registry.
   • CUse a configuration management tool to install the same tools on the build server after each build.
   • DSnapshot the build server's filesystem after each build and restore it before the next build.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A development team is concerned about the risk of a compromised transitive dependency. They want to reduce their attack surface by minimizing the number of dependencies they directly manage. Which practice best addresses this concern?

   • AOnly use dependencies that are written in the same programming language as the application.
   • BAudit direct dependencies and remove any that are not essential, preferring libraries with fewer transitive dependencies.
   • CReplace all third-party libraries with custom in-house code.
   • DUse a tool that automatically updates all dependencies to the latest versions.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A development team wants to make their build pipeline reproducible so that the same source code always produces the same binary. They currently use a build environment that installs the latest versions of all tools and dependencies at build time. Which change should they make first?

   • AAdd a post-build step that records the build timestamp in the binary.
   • BUse a container image with pinned tool versions and commit a lock file for all dependencies.
   • CUse a different build agent for each build to avoid resource contention.
   • DIncrease the build timeout to allow more time for dependency downloads.
   Reveal Solution Discussion Select an answer first