Supply Chain Compliance KCSA Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the purpose of verifying the integrity of an artifact?

   • ATo determine the license of the artifact
   • BTo ensure the artifact has not been altered or corrupted
   • CTo measure the performance of the artifact
   • DTo check if the artifact is compatible with the target platform
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A platform team uses a central artifact repository to store all third-party dependencies. A new critical vulnerability is disclosed for a library used by many applications. The team needs to identify all affected applications and update them quickly. What is the most efficient process?

   • AUse the artifact repository's dependency analysis feature to generate a list of all projects that use the vulnerable library, then coordinate updates through the CI/CD pipeline.
   • BSend an email to all developers asking them to check their applications for the vulnerable library.
   • CManually search the source code of each application for the library name and update them one by one.
   • DBlock the vulnerable library in the repository and wait for developers to complain about build failures.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary purpose of the SLSA framework?

   • ATo define a programming language for cloud-native applications
   • BTo provide a list of approved software vendors
   • CTo regulate the use of open-source licenses
   • DTo provide a set of standards for securing the software supply chain
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A development team uses a public package registry to pull open-source libraries. During a routine audit, they discover that a popular dependency was recently updated with a version that includes unexpected binary blobs and obfuscated code. The maintainer's account shows signs of unauthorized access. The team must continue using this library while ensuring the artifact they deploy is safe. What should they do first?

   • AContinue using the latest version but add a runtime security scanner to monitor for malicious behavior.
   • BContact the package registry support team to request a rollback of the compromised version.
   • CPin the dependency to the last known-good version and verify its checksum against the maintainer's published signature before building.
   • DDelete the dependency from the codebase and rewrite the affected functionality using internal code.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company wants to achieve a high level of supply chain security and is considering adopting SLSA Level 3. They currently have a CI/CD pipeline that builds artifacts and signs them. What is the key additional requirement they must meet to reach SLSA Level 3?

   • AThe build must be performed on a developer's local machine to ensure it is reproducible.
   • BThe build process must be fully automated and generate non-forgeable provenance that identifies the build's source and dependencies.
   • CThe artifacts must be signed with a key that is stored on the developer's machine.
   • DThe company must publish the source code of the application to a public repository.
   Reveal Solution Discussion Select an answer first