Verify Pedigree and Provenance CSSLP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which algorithm is commonly used to compute a cryptographic hash for verifying software integrity?

   • ABase64
   • BRSA-2048
   • CSHA-256
   • DAES-256
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Why is isolation important for a build environment?

   • ATo prevent a compromised build from affecting other systems and to ensure builds are reproducible.
   • BTo allow developers to access the build environment from anywhere.
   • CTo speed up the compilation of large codebases.
   • DTo reduce the cost of build infrastructure by sharing resources.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which protocol is designed to provide authenticated and encrypted file transfers over a secure channel?

   • AHTTP (Hypertext Transfer Protocol)
   • BSMTP (Simple Mail Transfer Protocol)
   • CSFTP (SSH File Transfer Protocol)
   • DFTP (File Transfer Protocol)
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Why is the right to audit important for supply chain security?

   • AIt transfers all liability for security breaches to the supplier.
   • BIt enables the customer to verify that the supplier's security controls are actually implemented and effective.
   • CIt allows the customer to access the supplier's source code at any time.
   • DIt automatically ensures the supplier's software is free from all vulnerabilities.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security engineer downloads a software artifact from a vendor's website. The vendor provides a SHA-256 checksum. The engineer computes the checksum of the downloaded file and it matches. However, the engineer is still concerned about the authenticity of the file. Why might the checksum match be insufficient?

   • AThe checksum algorithm is too weak to detect tampering.
   • BThe checksum must be recomputed after installation to be valid.
   • CThe checksum only verifies integrity, not that the file came from the vendor; an attacker could have replaced both the file and the checksum on the website.
   • DThe checksum must be verified over a secure connection to be valid.
   Reveal Solution Discussion Select an answer first