Supply Chain Compliance KCSA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company is required by a new regulation to demonstrate that their software build process is secure and that artifacts have verifiable provenance. They are looking for a set of best practices to implement. Which framework is most directly applicable to this requirement?

   • APCI DSS (Payment Card Industry Data Security Standard)
   • BNIST SSDF (Secure Software Development Framework)
   • COWASP Top 10 for Web Applications
   • DCIS Benchmarks for Kubernetes
   Reveal Solution Discussion Select an answer first
2. 2application · easy

   A company's security team is investigating a potential supply chain attack. They find that a legitimate library was modified to include a backdoor, and this modified version was published to a public repository. Which type of supply chain threat does this represent?

   • AA denial-of-service attack on the repository, preventing access to legitimate libraries.
   • BA misconfiguration in the build server that accidentally includes debug code.
   • CA phishing attack targeting the developers who use the library.
   • DA compromised dependency, where a trusted component is altered to include malicious code.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A development team is adopting a secure SDLC. They have a policy that all dependencies must be approved by the security team before use. However, this is causing significant delays because developers are waiting for approvals. They want to streamline the process without reducing security. What is the best approach?

   • AAllow developers to approve their own dependencies and only involve security if a vulnerability is found later.
   • BRemove the approval process entirely and allow developers to use any dependency they find.
   • CImplement an automated policy engine that allows dependencies from a pre-approved list of trusted sources and versions, while flagging new or unknown dependencies for manual review.
   • DRequire developers to submit a detailed risk assessment for every dependency, even if it is commonly used.
   Reveal Solution Discussion Select an answer first
5. 4application · easy

   A security analyst is mapping the software supply chain for a web application. They identify the source code repository, the CI/CD build server, the container registry, and the production Kubernetes cluster. Which component is considered the 'distribution channel' in this chain?

   • AThe source code repository where developers commit code.
   • BThe CI/CD build server that compiles the code.
   • CThe container registry that stores and serves the built images.
   • DThe production Kubernetes cluster that runs the application.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A team manages a Kubernetes application that depends on several third-party Helm charts. They want to ensure that the exact version of a chart used in production is the same one that was tested in staging. Which approach provides the strongest guarantee?

   • AStore the exact chart version in a private chart repository and reference it by a specific version number in the deployment manifest.
   • BUse a wildcard version range in the manifest to always get the latest patch release.
   • CDownload the chart from the public repository each time and verify its SHA-256 checksum before installation.
   • DCopy the chart's source code into the application repository and build it from source each time.
   Reveal Solution Discussion Select an answer first