Supply Chain Security KCSA Practice Questions (Page 9)

Questions 41–42

1. 41application · medium

   A development team uses a shared GitHub repository for a microservices application. A recent incident showed that a compromised developer account pushed a malicious commit directly to the main branch, which then triggered a production deployment. The team wants to prevent direct pushes to main and require peer review for all changes. Which configuration should they implement?

   • ARequire all commits to be signed with GPG and reject unsigned commits.
   • BConfigure a webhook to notify the security team whenever a push occurs to main.
   • CEnable branch protection on main, requiring pull requests and at least one approving review before merging.
   • DSet the repository to private and restrict access to only the development team.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which of the following is a common method to verify the integrity of a downloaded software artifact?

   • AChecking the file size against the expected size
   • BComparing its SHA-256 checksum with the one published by the vendor
   • CEnsuring the file is downloaded over HTTPS
   • DReading the README file included in the archive
   Reveal Solution Discussion Select an answer first