Understand Your Supply Chain (e.g. SBOM, CI/CD, Artifact Repositories) CKS Practice Questions (Page 6)

Questions 26–28

1. 26foundation · easy

   What is 'provenance' in the context of software supply chain security?

   • AThe performance metrics of the artifact
   • BThe history of an artifact, including its origin and how it was built
   • CThe process of encrypting artifacts
   • DThe license under which the artifact is distributed
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   Your CI/CD pipeline builds a container image and pushes it to a registry. You want to ensure that the image is built from source code that has been reviewed and approved, and that the image itself is not tampered with after the build. You have limited time to implement a solution. Which approach provides the strongest assurance with the least overhead?

   • AUse a unique tag for each build and maintain a list of approved tags in a ConfigMap.
   • BUse a private registry and restrict access to the pipeline service account.
   • CGenerate an SBOM for the image and store it in the registry.
   • DSign the image in the pipeline and verify the signature in the cluster's admission controller.
   Reveal Solution Discussion Select an answer first
3. 28application · medium

   Your team uses a CI/CD pipeline to build a Java application. You need to produce a machine-readable SBOM that can be automatically consumed by your security tooling and that supports component-level vulnerability tracking. Which format and tool combination is most appropriate?

   • AGenerate a plain-text list of dependencies using `mvn dependency:list`.
   • BGenerate a CycloneDX SBOM using a tool like Syft or CycloneDX Maven plugin.
   • CUse `docker save` to export the image and treat the tar file as an SBOM.
   • DExport the build log to a JSON file and save it as an SBOM.
   Reveal Solution Discussion Select an answer first