Software Supply Chain Security GCSA Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A company's CI/CD pipeline builds container images using a shared, long-lived build agent that has broad permissions to the production registry. After a supply chain incident, the security team wants to reduce the blast radius of a compromised build. Which change best aligns with SLSA Level 2 principles?

   • AUse ephemeral, isolated build runners with scoped credentials and generate provenance attestations for each build.
   • BAdd a manual approval step before any build artifact is pushed to the registry.
   • CRotate the build agent's credentials every 90 days.
   • DMove the build to a dedicated on-premises server with no internet access.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A security team discovers that a popular open-source library used by multiple internal applications was compromised. The library's maintainer account was hijacked, and a malicious version was published to the public registry. The team's applications use a lock file that pins the library to a specific version. What is the immediate risk and the best first response?

   • AThe lock file protects the application because it prevents any version changes, so no immediate action is needed.
   • BThe pinned version in the lock file may be the malicious one; the team should verify the integrity of the pinned version and check for any published security advisories.
   • CThe team should block all network access to the public registry to prevent further downloads.
   • DThe team should immediately delete the lock file and update to the latest version of the library.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A software vendor wants to provide customers with verifiable evidence that a released binary was built from the exact source code in their repository and that the build process was not tampered with. The vendor already signs the binary with its private key. What additional control should the vendor implement to meet this goal?

   • AGenerate a signed provenance attestation that includes the source commit hash, build environment, and build command.
   • BUse a code obfuscation tool to make reverse engineering harder.
   • CPublish the source code on a public repository and encourage customers to build from source.
   • DAdd a watermark to the binary that includes the build date.
   Reveal Solution Discussion Select an answer first
5. 44application · medium · select all that apply

   A security analyst is using an SBOM to assess the risk of a new application. The SBOM lists several direct and transitive dependencies. Select all that apply to properly use the SBOM.

   • AUse the SBOM to identify the exact versions of all components, including transitive dependencies.
   • BCheck the SBOM for any components that are not accounted for in the organization's approved dependency list.
   • CDelete the SBOM after the initial review because it is only needed during development.
   • DCross-reference the SBOM with vulnerability databases to identify known vulnerabilities in the listed components.
   Check answers Discussion Select an answer first
6. 45expert · hard

   A security incident is declared after a malicious dependency is found in a production application. The malicious dependency was introduced through a direct dependency that was updated by a developer two weeks ago. The team has identified the malicious package and removed it from the registry. Which sequence of actions best follows the incident response phases of containment, eradication, and recovery?

   • ANotify the development team and ask them to review the code changes from the last two weeks, then decide on next steps.
   • BIsolate affected systems, remove the malicious dependency from the application and rebuild, then restore service and monitor for signs of compromise.
   • CDelete the malicious package from the registry and wait for the next scheduled deployment to update the application.
   • DImmediately rebuild the application with the latest versions of all dependencies and redeploy, then rotate all credentials.
   Reveal Solution Discussion Select an answer first