Software Supply Chain Security GCSA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A development team uses a package manager that resolves dependencies at build time. After a recent incident where a malicious version of a transitive dependency was served, the team wants to ensure that the exact same dependency versions are used in every build and that those versions can be verified against the registry. Which two actions should the team implement together?

   • ACommit a lock file and verify package checksums against the registry.
   • BGenerate an SBOM after each build and store it in the artifact repository.
   • CRun dependency scans daily and update all packages to the latest versions.
   • DUse a private registry mirror and disable all external package sources.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   How can an SBOM be used to identify known vulnerabilities in software?

   • ABy checking the digital signature of the SBOM
   • BBy cross-referencing the listed components with vulnerability databases
   • CBy running the software in a sandbox and observing behavior
   • DBy comparing the SBOM to the software's source code
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company's CI/CD pipeline builds a Java application using a shared build server that also runs nightly batch jobs. The pipeline fetches dependencies from the internet and runs tests as root. The security team wants to reduce the risk of a compromised dependency or build tool affecting other workloads. Which change should be prioritized?

   • AUse a private artifact repository to cache all dependencies and disable internet access from the build server.
   • BAdd a step to the pipeline that scans all dependencies for known vulnerabilities before the build starts.
   • CSchedule the nightly batch jobs to run after all CI builds complete to avoid resource contention.
   • DRun each build in an isolated ephemeral container with a non-root user and no network access to other internal systems.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the first step in responding to a software supply chain compromise?

   • AIdentification and assessment
   • BContainment
   • CEradication
   • DRecovery
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security auditor is reviewing a company's software supply chain and finds that the build server automatically downloads a custom build tool from a public file-sharing site over HTTP. The auditor flags this as a supply chain risk. Which attack vector is the primary concern?

   • AThe build tool may contain a known vulnerability that is not patched.
   • BA man-in-the-middle attacker could replace the build tool with a malicious version during download.
   • CThe build server may be overloaded by the download.
   • DThe build tool may be incompatible with the company's operating system.
   Reveal Solution Discussion Select an answer first