In a supply chain incident response plan, what is the purpose of the eradication phase?

To prevent the incident from spreading

To identify the source of the compromise

To remove the malicious component from the environment

To restore systems to normal operation

A software vendor wants to achieve SLSA Level 3 for their build process. They currently have a CI system that runs builds on shared agents and generates provenance attestations. Which additional requirement must they meet to reach SLSA Level 3?

Sign the final artifact with the vendor's private key.

Add a manual approval step for each release.

Generate an SBOM for each release.

Run builds on a hosted build service that provides strong isolation and generates provenance that is tamper-proof.

What is an attestation in the context of software supply chain security?

A vulnerability report generated by a scanner

A signed statement that provides evidence about a software artifact

A cryptographic hash of the artifact

A license file that accompanies the artifact

A security team is evaluating a new third-party component for use in their application. They want to understand the component's dependencies and check for known vulnerabilities before approval. Which artifact should they request from the vendor?

A software bill of materials (SBOM) for the component.

A signed copy of the component's binary.

A copy of the vendor's source code repository.

A penetration test report from the vendor.

Which practice is recommended to reduce the attack surface from third-party code?

Using the latest version of every dependency

Storing all dependencies in a single shared repository

Automatically updating dependencies without review

Minimizing the number of direct dependencies

GIAC Cloud Security Automation

Domain 5Objective 3

Software Supply Chain Security GCSA Practice Questions (Page 6)

Part of the Identity, Secrets, and Supply Chain domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

8concepts

Questions 26–30

26foundation · easy
In a supply chain incident response plan, what is the purpose of the eradication phase?
Select an answer first
27expert · hard
A software vendor wants to achieve SLSA Level 3 for their build process. They currently have a CI system that runs builds on shared agents and generates provenance attestations. Which additional requirement must they meet to reach SLSA Level 3?
Select an answer first
28foundation · easy
What is an attestation in the context of software supply chain security?
Select an answer first
29application · medium
A security team is evaluating a new third-party component for use in their application. They want to understand the component's dependencies and check for known vulnerabilities before approval. Which artifact should they request from the vendor?
Select an answer first
30foundation · easy
Which practice is recommended to reduce the attack surface from third-party code?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.