Supply Chain Security KCSA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the purpose of a policy engine like Open Policy Agent (OPA) in the context of supply chain security?

   • ATo store secrets securely
   • BTo manage Kubernetes cluster networking
   • CTo automatically fix vulnerabilities in container images
   • DTo define and enforce fine-grained policies across the software supply chain
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is an effective mitigation against typosquatting attacks in package registries?

   • ADisabling all package managers in the CI/CD pipeline
   • BAlways using the latest version of every package
   • COnly using packages that are written in the same programming language as the project
   • DUsing a package manager that verifies the integrity of packages via checksums and signatures
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which secure coding practice is most effective at preventing SQL injection vulnerabilities?

   • AUsing parameterized queries or prepared statements
   • BValidating user input only on the client side
   • CEncoding all user input with base64 before including it in queries
   • DUsing stored procedures exclusively
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst discovers that a popular open-source library used by their application was compromised. The library's repository was taken over, and a malicious version was published to the package registry. The team's application uses a version range that allowed the malicious version to be pulled. Which mitigation would have prevented this attack?

   • APinning the exact version of the library in the dependency lock file and verifying the integrity of the downloaded package.
   • BUsing a different package registry that is known to be secure.
   • CUsing the latest version of the library to ensure all security patches are applied.
   • DMonitoring the library's GitHub repository for unusual activity.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A platform team wants to enforce that all images deployed to their cluster have an SBOM and are signed by the CI/CD system. They plan to use an admission controller. Which policy should they implement?

   • AReject images that have known critical vulnerabilities.
   • BRequire that all images come from a specific registry.
   • CAllow all images but generate a report of images that lack an SBOM or signature.
   • DReject any pod that uses an image without a valid signature and an SBOM attestation.
   Reveal Solution Discussion Select an answer first