Understand and Manage Dependency and Supply Chain Risks GH-500 Practice Questions (Page 3)

Questions 11–14

1. 11foundation · easy

   What is a key difference between the SPDX and CycloneDX SBOM formats?

   • ASPDX is used only for container images, while CycloneDX is used only for source code
   • BSPDX only supports JSON, while CycloneDX only supports XML
   • CSPDX is a proprietary format, while CycloneDX is open source
   • DSPDX is more focused on license compliance, while CycloneDX is more focused on security and component inventory
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A team has just enabled the dependency graph for a large monorepo that contains multiple package manifests (package.json, requirements.txt, Gemfile). After 24 hours, the dependency graph shows no data. What is the most likely reason for this?

   • AThe dependency graph only supports one manifest file per repository, so the monorepo structure is unsupported.
   • BThe repository is private and dependency graph generation is not supported for private repositories.
   • CThe repository's default branch is not the branch where the manifests are located.
   • DThe dependency graph requires a GitHub Actions workflow to be run manually before it can detect dependencies.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of a Software Bill of Materials (SBOM) in the context of supply chain security?

   • ATo provide a machine-readable inventory of the components and dependencies that make up a software product
   • BTo automatically fix known vulnerabilities in a repository's dependencies
   • CTo replace the dependency graph feature in GitHub
   • DTo list only the direct dependencies of a project, excluding transitive ones
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A developer notices that the dependency graph for a Go repository shows a vulnerability in a package that is not directly imported in any source file. The developer is confused because they don't see it in their go.mod. What should you explain?

   • AThe dependency graph includes transitive dependencies, so the vulnerable package is likely a dependency of a direct dependency.
   • BThe dependency graph is showing a vulnerability from a different branch that was merged recently.
   • CThe vulnerability is a false positive because the package is not in the go.sum file.
   • DThe dependency graph only shows direct dependencies, so the vulnerability must be in a tool that was run during the build.
   Reveal Solution Discussion Select an answer first