Secure Software Supply Chain

When evaluating a vendor's open-source usage, which factor is the strongest indicator of a proactive security posture?

During a vendor security assessment, you require a supplier to provide proof that their software is signed. Which mechanism should you verify to ensure the code's integrity and origin authenticity?

An organization is concerned about 'Typosquatting' in their build system. Which strategy is most effective at preventing the accidental inclusion of malicious, similarly-named packages?

You are setting up an automated policy in GitHub Actions to block builds that contain dependencies with known high-severity vulnerabilities. Which tool is standard for this type of automated gated check?

Your development team is integrating a new third-party library via npm. To prevent dependency confusion attacks where a malicious package is pulled from a public registry instead of your internal private registry, which configuration should be applied?

You are using 'in-toto' to secure your software supply chain. What is the primary purpose of a 'layout' file in this framework?

What is the primary function of a 'Vulnerability Disclosure Policy' (VDP) in a vendor's secure development lifecycle?

You notice that your build server environment pulls Docker images from a public registry with the ':latest' tag. Why is this a major supply chain security flaw?

A supplier asks you to describe your 'Supply Chain Security Policy'. What is the most appropriate foundational element to include?

When assessing a SaaS provider's supply chain, you are concerned about their 'Vendor Risk Management' (VRM) program. Which practice indicates a mature approach to fourth-party risk?

An organization is adopting the SLSA (Supply-chain Levels for Software Artifacts) framework. To achieve Level 3, what requirement must be met regarding the build platform?

When performing a vendor security assessment for a new SaaS product, which THREE of the following should be requested to evaluate their supply chain resilience?

To protect against a compromised build pipeline, which TWO of the following configurations should be implemented to ensure 'Hermetic Builds'?

Which THREE of the following are common threats to the Software Supply Chain that an SBOM can help mitigate?

When designing an automated pipeline to prevent supply chain attacks, which THREE of the following features should be included in your artifact registry?

Which TWO of the following are essential components of an effective Vendor Security Assessment program?

A financial services firm mandates that every open-source component pulled into its build pipeline must carry a cryptographically signed provenance attestation from the original project maintainer. During a review, you discover that Sigstore's cosign verification succeeds, but the attestation was generated by an internal CI runner rather than the upstream maintainer. What is the most significant supply chain risk introduced by this configuration?

You are designing a secure software supply chain for a healthcare application that must comply with FDA premarket cybersecurity guidance. Your team proposes using the OWASP Dependency-Check tool within the CI pipeline to identify vulnerable third-party libraries. Which TWO additional practices are essential to establish a defensible component governance process that meets regulatory expectations? (Choose two.)

A software vendor provides a critical component to your organization. During contract negotiations, you request that the vendor provide a Software Bill of Materials (SBOM) for each release. The vendor agrees to provide a document listing all open-source libraries and their versions. Which additional attribute is most important to include in the SBOM to support rapid vulnerability response?

Your organization is adopting the SLSA framework to improve supply chain security. You are evaluating a build system that claims to meet SLSA level 3. During an assessment, you find that the build system generates provenance but does not sign it, and the provenance is stored on the same server that performs builds. Which SLSA level requirement is most directly violated by this finding?