A development team uses a package manager that supports lock files and checksum verification. They want to ensure that the exact same dependency versions are used in development, staging, and production, and that the packages have not been tampered with. Select all that apply.

Generate an SBOM after each build to document the exact dependency versions used.

Use a version range like '>=1.0.0' in the lock file to allow automatic updates.

Enable checksum verification in the package manager to validate package integrity.

Commit the lock file to the repository and use it in all environments.

Why is it important to isolate build environments in a CI/CD pipeline?

To ensure that all builds use the same operating system

To allow developers to access the build environment for debugging

To speed up the build process by using dedicated hardware

To reduce the risk that a compromised build can affect other builds or systems

What does verifying a software artifact's digital signature provide beyond a simple hash check?

Assurance of the artifact's origin and integrity

Assurance that the artifact has not been modified since signing

Confirmation that the artifact is from a trusted repository

Proof that the artifact is free of vulnerabilities

A company is implementing NIST SSDF practices for their software development lifecycle. They have already implemented secure coding training and code review. They now want to focus on the 'Protect the Integrity of Software' practice area. Which control should they prioritize?

Conduct regular penetration tests on the production environment.

Deploy a web application firewall in front of the application.

Implement a bug bounty program to encourage external security research.

Generate and verify provenance attestations for all build artifacts.

A security analyst discovers that a popular open-source library used by the company's application was recently compromised. The library's maintainer account was hijacked, and a malicious version was published to the public registry. The company's build pipeline automatically pulls the latest version of this library. The incident response team needs to contain the threat and prevent recurrence. Which combination of actions should be taken first?

Pin the library to a known-good version, verify its checksum, and audit the build pipeline for any artifacts built with the malicious version.

Immediately rotate all credentials used by the build pipeline and notify the library maintainer.

Generate an SBOM for all current applications and compare it to the CVE database.

Delete the library from all internal mirrors and block the registry domain at the firewall.

GIAC Cloud Security Automation

Domain 5Objective 3

Software Supply Chain Security GCSA Practice Questions (Page 4)

Part of the Identity, Secrets, and Supply Chain domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

8concepts

Questions 16–20

16application · medium · select all that apply
A development team uses a package manager that supports lock files and checksum verification. They want to ensure that the exact same dependency versions are used in development, staging, and production, and that the packages have not been tampered with. Select all that apply.
Select an answer first
17foundation · easy
Why is it important to isolate build environments in a CI/CD pipeline?
Select an answer first
18foundation · easy
What does verifying a software artifact's digital signature provide beyond a simple hash check?
Select an answer first
19expert · hard
A company is implementing NIST SSDF practices for their software development lifecycle. They have already implemented secure coding training and code review. They now want to focus on the 'Protect the Integrity of Software' practice area. Which control should they prioritize?
Select an answer first
20expert · hard
A security analyst discovers that a popular open-source library used by the company's application was recently compromised. The library's maintainer account was hijacked, and a malicious version was published to the public registry. The company's build pipeline automatically pulls the latest version of this library. The incident response team needs to contain the threat and prevent recurrence. Which combination of actions should be taken first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.