Verify Pedigree and Provenance CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which security measure is specifically designed to prevent unauthorized changes to a protected branch in a code repository?

   • AEnabling two-factor authentication for all repository users.
   • BUsing a .gitignore file to exclude sensitive files.
   • CSetting the repository to private so only invited users can see it.
   • DBranch protection rules that require pull request reviews and status checks before merging.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A software vendor distributes a signed binary and a detached signature file. A consumer wants to verify that the binary was indeed produced by the vendor and has not been altered. Which process is correct?

   • AVerify the detached signature using the vendor's public key and the binary's hash.
   • BDecrypt the binary using the vendor's public key.
   • CCompare the binary's size with the size listed on the vendor's website.
   • DHash the binary and compare it with the hash embedded in the signature file without verifying the signature.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A DevOps team needs to transfer a signed software artifact from an internal build server to a production repository hosted in a different cloud region. The artifact is large, and the team wants to ensure confidentiality and integrity during transit. Which approach best meets these requirements?

   • AUse HTTP with a pre-shared key embedded in the URL to protect the transfer.
   • BUse SFTP over SSH to transfer the artifact, and also verify the artifact's checksum after transfer.
   • CUse plain FTP and rely on the artifact's digital signature to detect any tampering during transit.
   • DUse a USB drive shipped via courier, and verify the checksum upon arrival.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company's build system automatically fetches open-source libraries from a public package repository. The security team wants to reduce the risk of a malicious package being introduced into the build. Which control is most effective?

   • AScan the build environment with an antivirus tool before each build.
   • BRestrict network access to the public repository to a single administrator's workstation.
   • CUse a private package mirror that is populated only after manual review and approval of each package.
   • DEnable automatic updates for all packages to ensure the latest versions are used.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which practice is essential when interconnecting your software supply chain systems with external partners?

   • ADisabling all logging to avoid performance overhead.
   • BAllowing all traffic to flow freely to ensure seamless integration.
   • CDocumenting the data flow and applying security controls at each trust boundary.
   • DUsing the same credentials for all systems to simplify management.
   Reveal Solution Discussion Select an answer first