Software Supply Chain Security GCSA Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   An organization discovers that a malicious package was published to an internal artifact registry and was pulled into several applications during a recent build. The malicious package has been identified and removed from the registry. What should be the next step in the incident response process?

   • AIdentify all artifacts and applications that contain the malicious package by analyzing SBOMs and build logs.
   • BNotify the public registry of the malicious package and wait for them to remove it.
   • CImmediately rebuild all applications from scratch without checking which versions were affected.
   • DChange all developer credentials as a precautionary measure.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   An attacker publishes a malicious library with a name very similar to a popular open-source package, hoping developers will accidentally include it. This is an example of which supply chain attack vector?

   • ABuild tool compromise
   • BTyposquatting
   • CDistribution channel hijacking
   • DDependency confusion
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security engineer is configuring a script that downloads a third-party binary and its signature file from the vendor's website. The engineer wants to verify the binary's authenticity before using it. Which command should the engineer use?

   • ACompare the binary's SHA-256 hash to a hash found on a public forum.
   • BUse the vendor's public key to verify the signature against the binary.
   • CRun the binary in a sandbox and observe its behavior.
   • DCheck the binary's file size against the size listed on the website.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A company runs a monolithic build pipeline on a shared Jenkins server. The pipeline uses a single set of credentials to push artifacts to production and to pull dependencies from a private registry. A recent audit found that a developer's personal access token was leaked and could have been used to modify the pipeline configuration. The team wants to reduce the risk of a compromised pipeline pushing malicious artifacts, but they also need to minimize disruption to the current build process. Which combination of changes best addresses the risk?

   • AMove the pipeline to a new server and use the same credentials to minimize configuration changes.
   • BRotate the leaked token and continue using the same pipeline with a single set of credentials.
   • CUse short-lived credentials for the pipeline, separate credentials for pulling dependencies and pushing artifacts, and require manual approval for production pushes.
   • DDisable the pipeline and require all builds to be run manually by developers on their local machines.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A development team uses a popular JavaScript framework that has many transitive dependencies. They want to reduce the attack surface and make their SBOM more manageable. Which approach best achieves this?

   • AUse a tool to analyze the dependency tree and remove any direct dependencies that are not actually used in the code.
   • BSwitch to a different framework that has fewer dependencies, even if it requires rewriting the application.
   • CAdd more direct dependencies to override transitive versions and pin them to known-good versions.
   • DGenerate an SBOM and manually remove entries for transitive dependencies to make it shorter.
   Reveal Solution Discussion Select an answer first