Supply Chain Security KCSA Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company wants to ensure that only images signed by their CI/CD pipeline can be deployed to their Kubernetes cluster. They have implemented image signing using cosign. What additional component is required to enforce this policy at deployment time?

   • AA cron job that periodically re-signs all images in the registry.
   • BAn admission controller that verifies the image signature before allowing the pod to be created.
   • CA Kubernetes secret containing the private key used for signing.
   • DA network policy that restricts which nodes can pull images from the registry.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company distributes a CLI tool as a container image. To help customers verify that the image they pull is exactly what the company published and has not been tampered with, the company wants to provide a way for customers to check the image's authenticity and integrity. Which artifact should the company publish alongside the image?

   • AA cryptographic signature of the image digest, generated with a private key held by the company.
   • BThe public key used to sign the image, published in the image repository.
   • CA SHA-256 checksum of the image file, published on the company website.
   • DA Software Bill of Materials (SBOM) listing all components in the image.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company is adopting a secure software development lifecycle (SSDLC) for their cloud native applications. They want to integrate security activities into each phase of development, from design to deployment. Which practice best exemplifies integrating security into the development phase?

   • APerforming static application security testing (SAST) as part of the code commit process.
   • BReviewing the software bill of materials (SBOM) after deployment.
   • CConducting threat modeling during the design phase to identify potential security issues.
   • DRunning dynamic application security testing (DAST) against the production environment.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is the purpose of pinning dependency versions in a project?

   • ATo ensure that builds are reproducible and not affected by unexpected dependency updates
   • BTo automatically update dependencies to the latest versions
   • CTo reduce the number of dependencies in the project
   • DTo make the code run faster by using optimized versions
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   In a Secure Software Development Lifecycle (SSDLC), what is the primary purpose of the 'design' phase?

   • ATo automate the build and deployment pipeline
   • BTo identify security requirements and perform threat modeling
   • CTo perform penetration testing on the final application
   • DTo monitor the application in production for anomalies
   Reveal Solution Discussion Select an answer first