Verify Pedigree and Provenance CSSLP Practice Questions (Page 6)

Questions 26–28

1. 26foundation · easy

   Which practice is used to verify the integrity of a build environment before it is used?

   • AUsing the same environment for all builds without checking for changes.
   • BComparing the build environment's configuration against a known-good baseline.
   • CAllowing any developer to modify the build environment as needed.
   • DDisabling all security controls to speed up the build.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What does a digital signature on a software artifact provide beyond a cryptographic hash?

   • AA guarantee that the artifact is free from all security vulnerabilities.
   • BA timestamp that proves the artifact was created at a specific time.
   • CProof of the signer's identity and assurance that the artifact has not been altered since signing.
   • DEncryption of the artifact's contents to protect confidentiality.
   Reveal Solution Discussion Select an answer first
3. 28foundation · easy

   Why is audit logging important for a code repository?

   • AIt provides a record of who accessed the repository and what actions they performed, enabling detection of unauthorized activity.
   • BIt encrypts the repository contents at rest.
   • CIt automatically fixes security vulnerabilities in the code.
   • DIt speeds up the build process by caching dependencies.
   Reveal Solution Discussion Select an answer first