Verify Pedigree and Provenance CSSLP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which method is used to verify the integrity of a software artifact after it has been transferred?

   • AEnsuring the artifact was downloaded over a secure protocol such as HTTPS.
   • BComparing a freshly computed cryptographic hash of the artifact to a published hash value.
   • CChecking the artifact's file size against the size listed on the download page.
   • DReviewing the artifact's version number to confirm it matches the expected release.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the 'right to audit' clause in a supplier contract?

   • AA provision that allows the supplier to audit the customer's systems.
   • BA contractual provision that allows the customer to inspect the supplier's security practices and controls.
   • CA legal requirement that all suppliers must be audited by a government agency.
   • DA guarantee that the supplier's software is free from vulnerabilities.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A software company integrates a third-party component library into its product. The library is hosted in a public repository, and the company's build system pulls the library directly from that repository during each build. The security team is concerned about the trust boundary between the public repository and the internal build environment. Which control best reduces the risk of a compromised or tampered component entering the build?

   • ADisable all network access from the build environment and manually copy the library from a developer's workstation.
   • BUse a VPN to connect the build environment directly to the public repository for each build.
   • CConfigure the build system to pull directly from the public repository but require a checksum match against a known-good value.
   • DMirror the third-party repository into an internal, access-controlled repository and configure the build system to pull from the internal mirror only.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security auditor is reviewing the provenance of a software artifact that was transferred from a developer's workstation to a build server and then to a production environment. The auditor wants to ensure that the artifact was not altered at any point. Which evidence is most important to collect?

   • AThe final checksum of the artifact in the production environment.
   • BThe network logs from the build server showing the transfer occurred.
   • CThe digital signature of the artifact from the original developer.
   • DA chain of custody log that records each transfer, including timestamps, responsible parties, and checksums or hashes at each step.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company's build server is shared among multiple development teams. The security team wants to ensure that a compromised build of one team cannot affect the builds of other teams. Which control is most effective?

   • AUse a shared build directory but restrict write access to the build server's administrator.
   • BRun each team's build in an isolated container or virtual machine with its own credentials and network access.
   • CScan all build artifacts with a vulnerability scanner before they are deployed.
   • DRequire all teams to use the same build script template.
   Reveal Solution Discussion Select an answer first