Verify Pedigree and Provenance CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of using TLS (Transport Layer Security) when downloading a software artifact?

   • ATo provide a permanent record of the download for audit purposes.
   • BTo verify that the artifact is free from malware.
   • CTo encrypt the data in transit and authenticate the server, preventing eavesdropping and man-in-the-middle attacks.
   • DTo compress the artifact to reduce download time.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security engineer at a financial software firm is responsible for verifying the pedigree of a third-party library before it is integrated into a critical application. The library was downloaded from the vendor's official site, and the vendor provides both a SHA-256 checksum and a detached PGP signature. The engineer has verified the checksum matches. Which additional step is essential to establish the authenticity and non-repudiation of the library?

   • AScan the library with a vulnerability scanner to confirm it contains no known security flaws.
   • BRecompute the SHA-256 checksum after installation to ensure the library has not been modified during the build process.
   • CCompare the library's version number with the latest release listed on the vendor's website to ensure it is current.
   • DVerify the PGP signature using the vendor's public key, which has been obtained from a trusted key server and cross-checked via the vendor's website.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A development team uses a Git repository to manage source code for a critical application. The security team wants to ensure that code changes are attributable to specific developers and that the history cannot be easily altered. Which combination of controls best achieves this?

   • ARequire all commits to be signed with the developer's GPG key and enable branch protection that requires signed commits for merges to the main branch.
   • BUse a pre-commit hook that runs a linter and unit tests before allowing a commit.
   • CConfigure the repository to automatically create a backup after every push.
   • DEnable two-factor authentication for all developers and restrict write access to the repository.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which record is a key component of a chain of custody for a software artifact?

   • AThe list of vulnerabilities found in the artifact during security testing.
   • BThe source code repository's commit history, showing all code changes.
   • CA log of every individual who accessed the artifact, along with timestamps and the nature of the access.
   • DThe license agreement between the supplier and the consumer.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is non-repudiation in the context of digital signatures?

   • AThe signer cannot deny having signed the component.
   • BThe signature is valid only for a limited time.
   • CThe signature can be used by anyone to verify the component.
   • DThe component cannot be copied or redistributed.
   Reveal Solution Discussion Select an answer first