Supply Chain Compliance KCSA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the purpose of a digital signature on a software artifact?

   • ATo encrypt the artifact to prevent unauthorized access
   • BTo verify the authenticity and integrity of the artifact
   • CTo convert the artifact into a different format
   • DTo compress the artifact for faster download
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security team is setting up continuous monitoring for their software supply chain. They have a central artifact repository and a CI/CD pipeline. They want to automatically detect when a new version of a dependency is published and assess its risk. What is the most effective approach?

   • AOnly scan dependencies when they are first added to a project, and never again.
   • BRely on the developers to check for new versions and report any security issues they find.
   • CManually check the public registry for new versions of all dependencies on a weekly basis.
   • DConfigure the artifact repository to automatically scan new versions for vulnerabilities and known malware, and alert the security team on findings.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company distributes a CLI tool as a container image. They want to allow customers to verify that the image was built by the company and has not been tampered with. Which mechanism should they implement?

   • AEmbed a watermark in the image that is visible when the image is inspected.
   • BPublish the SHA-256 digest of the image on the company website.
   • CSign the image with a private key and publish the public key for customers to verify the signature.
   • DHost the image in a private registry and share credentials with customers.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the role of the NIST SSDF in supply chain security?

   • AIt defines a set of mandatory security tools that all organizations must use
   • BIt provides a framework for integrating security practices into the software development lifecycle
   • CIt is a certification for software products
   • DIt is a list of known vulnerabilities in open-source software
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is a provenance attestation?

   • AA backup copy of the artifact stored in a different location
   • BA license that allows the artifact to be used commercially
   • CA list of all known vulnerabilities in the artifact
   • DA record that describes the origin and build process of an artifact
   Reveal Solution Discussion Select an answer first