Supply Chain Compliance KCSA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security team is evaluating frameworks to improve their software supply chain security. They need a framework that provides a formal specification for levels of build integrity and provenance, allowing them to set incremental goals. Which framework best fits this requirement?

   • ANIST SSDF (Secure Software Development Framework)
   • BSLSA (Supply-chain Levels for Software Artifacts)
   • CISO 27001 (Information Security Management)
   • DOWASP ASVS (Application Security Verification Standard)
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An organization is integrating security into its SSDLC. They want to ensure that newly discovered vulnerabilities in dependencies are addressed before they reach production. Which practice should they implement in the CI/CD pipeline?

   • AAutomatically fail the build if a dependency with a known critical vulnerability is detected by the scanner.
   • BRun a vulnerability scan only on the final production image before deployment.
   • CRequire developers to manually approve a vulnerability report before the build proceeds.
   • DStore the vulnerability scan report in a central location for auditing purposes only.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company is adopting a secure software development lifecycle (SSDLC) to reduce supply chain risk. Their current process builds container images directly from a developer's local machine and pushes them to a private registry. They want to introduce a control that ensures only code that has passed through a controlled pipeline is deployed. Which practice best achieves this?

   • AAdopt a policy that mandates all images be rebuilt from scratch every time a new dependency is released.
   • BImplement a policy that requires developers to scan their local images with a vulnerability scanner before pushing.
   • CUse a private registry that only allows pulls from authenticated users within the corporate network.
   • DRequire all builds to occur in a centralized CI/CD system that uses a locked base image and signs the resulting artifact.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Why is it important to lock dependency versions?

   • ATo ensure that builds are reproducible and not affected by unexpected changes in dependencies
   • BTo reduce the size of the application binary
   • CTo allow automatic updates of dependencies
   • DTo make the code easier to read
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is a component of the software supply chain?

   • AThe end-user's hardware specifications
   • BThe customer support ticketing system
   • CThe marketing strategy for the software product
   • DThe build system that compiles source code into artifacts
   Reveal Solution Discussion Select an answer first