A security team wants to identify which of their deployed applications are affected by a newly disclosed vulnerability in a popular logging library. The team has access to the container images stored in their registry. Which approach should they use to quickly determine affected applications?

Search the source code repositories for the library's import statements.

Check the application's documentation for the library version.

Generate an SBOM for each container image and scan the SBOM against vulnerability databases.

Run a network scan to identify applications that communicate with the logging library's update server.

A security team is reviewing the CI/CD pipeline for a web application. The pipeline currently runs on a shared build server with a single service account that has access to the production environment. The team wants to implement least privilege and isolate build environments. Select all that apply.

Use a dedicated service account for the build pipeline with only the permissions required for the build and deployment.

Use a separate, read-only credential for pulling dependencies from the private registry.

Run each build in a fresh, isolated container or VM that is destroyed after the build completes.

Grant the build service account write access to the production environment to allow direct deployment.

A company's security team has identified that a malicious version of a build tool was used in their CI/CD pipeline for the past month. The team needs to determine which released artifacts were affected. Which data source should they use?

The application's user documentation.

Provenance attestations and build logs from the CI/CD pipeline.

The source code repository's commit history.

What is the purpose of applying the principle of least privilege to a CI/CD pipeline?

To prevent developers from viewing pipeline logs

To give all pipeline steps equal access to resources for simplicity

To allow the pipeline to access all secrets in the organization

To ensure that every step has the minimum permissions required to perform its function

What is the primary goal of the SLSA framework?

To provide a set of standards for securing the software supply chain

To provide a list of known vulnerabilities in open-source software

To automate the deployment of software to production

GIAC Cloud Security Automation

Domain 5Objective 3

Software Supply Chain Security GCSA Practice Questions (Page 7)

Part of the Identity, Secrets, and Supply Chain domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

8concepts

Questions 31–35

31application · medium
A security team wants to identify which of their deployed applications are affected by a newly disclosed vulnerability in a popular logging library. The team has access to the container images stored in their registry. Which approach should they use to quickly determine affected applications?
Select an answer first
32application · medium · select all that apply
A security team is reviewing the CI/CD pipeline for a web application. The pipeline currently runs on a shared build server with a single service account that has access to the production environment. The team wants to implement least privilege and isolate build environments. Select all that apply.
Select an answer first
33application · medium
A company's security team has identified that a malicious version of a build tool was used in their CI/CD pipeline for the past month. The team needs to determine which released artifacts were affected. Which data source should they use?
Select an answer first
34foundation · easy
What is the purpose of applying the principle of least privilege to a CI/CD pipeline?
Select an answer first
35foundation · easy
What is the primary goal of the SLSA framework?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.