Software Supply Chain Security GCSA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An organization wants to meet SLSA Level 2 requirements for its build process. The build currently runs on a developer's laptop and pushes artifacts directly to a production registry. Which change is necessary to satisfy SLSA Level 2?

   • AUse a container image to package the build tools and run it on the developer's laptop with Docker.
   • BMove the build to a hosted CI/CD service that runs the build in an isolated environment and generates a signed provenance attestation for each artifact.
   • CGenerate an SBOM for the artifact and store it alongside the artifact in the registry.
   • DAdd a cryptographic hash of the artifact to the registry metadata and require two-person approval for releases.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team wants to automate the detection of known vulnerable components in their application before deployment. They have access to the application's dependency manifest. Which approach should they use?

   • AGenerate an SBOM from the dependency manifest and scan it against a vulnerability database.
   • BRun a network scan to identify outbound connections from the application.
   • CCheck the application's documentation for a list of dependencies.
   • DManually review the dependency manifest for suspicious package names.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company is adopting NIST SSDF practices for its software development lifecycle. They currently have a CI/CD pipeline that builds artifacts, but they do not generate provenance or verify the integrity of third-party components. Which SSDF practice should they implement first to improve supply chain security?

   • ASet up a vulnerability scanner that runs on the production environment nightly.
   • BImplement a code review process for all changes to the source code.
   • CGenerate and store provenance metadata for all build artifacts, including the build environment and dependencies used.
   • DRequire all developers to use multi-factor authentication on their accounts.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company's CI/CD pipeline uses a shared build cluster where multiple projects run builds on the same nodes. A security audit recommends isolating builds to reduce the risk of cross-project contamination. The team is considering using containerized build jobs. Which additional control is necessary to ensure that a compromised build cannot access other projects' secrets?

   • ARotate all secrets after every build.
   • BUse a separate container registry for each project.
   • CInject secrets only into the specific build job that needs them, using a secrets manager with scoped access.
   • DEnable network isolation between build containers.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company's CI/CD pipeline was compromised when an attacker gained access to a developer's account and modified the build script to exfiltrate secrets and inject malicious code into the produced artifacts. The malicious code was deployed to production before detection. The team has revoked the developer's access and removed the malicious code from the build script. What should be the next priority in the incident response?

   • ADisable the CI/CD pipeline until a full forensic investigation is completed.
   • BImmediately rebuild all artifacts from the current source code and redeploy to production.
   • CChange all secrets that were stored in the pipeline and rotate all developer credentials.
   • DIdentify all artifacts built during the compromise window and verify their integrity against the original source code.
   Reveal Solution Discussion Select an answer first