CSSLP › Secure Software Supply Chain
This domain covers securing everything that enters your build and release pipeline from outside your team: third-party libraries, container base images, vendor software, and SaaS dependencies. Questions present concrete supply chain scenarios — signed artifacts, npm registries, Docker tags, vendor risk programs — and ask you to pick the control or practice that actually closes the integrity, provenance, or fourth-party risk gap described.
CSSLP Secure Software Supply Chain — All 24 Questions
Every question in this domain with answers and detailed explanations.