Verify Pedigree and Provenance CSSLP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is a trust boundary in the context of system interconnections?

   • AThe point at which data flows from a system you control to a system you do not control, requiring explicit security controls.
   • BThe physical location where servers are housed in a data center.
   • CA firewall rule that blocks all incoming traffic.
   • DThe point where a software component is compiled into a binary.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What property of a cryptographic hash makes it useful for detecting tampering?

   • AA small change in the input produces a completely different hash value.
   • BThe hash can be reversed to recover the original data.
   • CThe hash is encrypted with a private key.
   • DThe hash value is always the same length as the input.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of maintaining a chain of custody for software components in a supply chain?

   • ATo document the component's history from creation through delivery, ensuring accountability and integrity at each step.
   • BTo assign a unique identifier to each component for inventory tracking purposes.
   • CTo encrypt the component so that only authorized parties can access it during transit.
   • DTo ensure that the component is stored in a tamper-evident container until it is installed.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company sources a critical software component from a third-party supplier. The supplier's development and build environments are not directly observable by the company. The company wants to verify the supplier's security practices and ensure the component's pedigree. Which action is most appropriate?

   • ARely on the supplier's self-reported compliance with industry standards.
   • BPerform a black-box penetration test on the component after integration.
   • CRequest a copy of the supplier's source code and review it manually for security flaws.
   • DExercise the contractual right to audit the supplier's development and build environments, including reviewing their access controls and build logs.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What does a digital signature provide for a software component?

   • AA timestamp of when the component was compiled.
   • BA guarantee that the component is free from vulnerabilities.
   • CConfidentiality of the component's contents.
   • DAuthentication of the signer and integrity of the component.
   Reveal Solution Discussion Select an answer first