Supply Chain Compliance KCSA Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security incident occurs: a popular open-source library was compromised, and a malicious version was published to a public registry. The company's applications use this library. The security team needs to respond. They have a central artifact repository that caches dependencies. What is the most effective immediate response?

   • ADelete the compromised version from the central repository and hope that applications do not use it.
   • BSend a notification to all developers and ask them to check their local machines for the compromised library.
   • CQuarantine the compromised version in the central repository, identify all applications using it, and rebuild them with a patched or alternative version.
   • DImmediately update the public registry's DNS to point to a safe mirror.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a common supply chain threat?

   • AA compromised dependency that contains malicious code
   • BA user forgetting their password to the code repository
   • CA network outage that delays a software release
   • DA developer accidentally deleting a local repository
   Reveal Solution Discussion Select an answer first
4. 18expert · medium

   A software vendor distributes a binary application. They want to provide a way for customers to verify that the binary was produced by them and has not been altered. They are considering publishing a SHA-256 checksum and a detached GPG signature. Which statement correctly describes the security properties of these two mechanisms?

   • AThe GPG signature verifies integrity, while the checksum verifies authenticity.
   • BThe checksum is more secure because it is faster to compute.
   • CThe checksum verifies integrity, while the GPG signature verifies both authenticity and integrity.
   • DBoth mechanisms provide the same level of security and are interchangeable.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following best describes the software supply chain?

   • AThe process of physically delivering software packages to end users via logistics networks
   • BThe set of tools used by developers to write and debug application code
   • CThe collection of cloud services that host and run containerized applications
   • DThe sequence of steps and components involved in creating, building, and distributing software, including source code, dependencies, build systems, and distribution channels
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company is migrating from a monolithic application to a microservices architecture. They currently manage dependencies by manually updating a shared library. They want to adopt a more secure and scalable approach. Which practice is most aligned with supply chain security best practices?

   • AUse a central artifact repository with version locking and automated vulnerability scanning for all shared libraries.
   • BUse the latest version of the shared library in all services without locking to ensure they are always up to date.
   • CAllow each microservice team to manage its own dependencies independently without central oversight.
   • DCopy the shared library's source code into each microservice's repository to avoid external dependencies.
   Reveal Solution Discussion Select an answer first