CSSLP Secure Software Supply Chain — 20 Questions

Question 1

You are implementing a Software Bill of Materials (SBOM) using the CycloneDX standard for your CI/CD pipeline. Which of the following fields is mandatory to uniquely identify an individual component within the SBOM to ensure accurate vulnerability tracking?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

purl. The purl (Package URL) is the standard identifier in CycloneDX for mapping components to vulnerability databases like the NVD.

Answer

hash-algorithm

Answer

author-email

Answer

license-id

Question 2

When evaluating a vendor's open-source usage, which factor is the strongest indicator of a proactive security posture?

Accepted Answer

The vendor maintains a documented process for tracking and patching vulnerable components.. A formal vulnerability disclosure program (VDP) and regular patching cycles demonstrate a vendor's commitment to managing third-party risks.

Answer

The vendor provides a static list of libraries once a year.

Answer

The vendor does not use any open-source software.

Answer

The vendor uses only the newest versions of all libraries.

Question 3

During a vendor security assessment, you require a supplier to provide proof that their software is signed. Which mechanism should you verify to ensure the code's integrity and origin authenticity?

Accepted Answer

Digital Signature (e.g., Authenticode or GPG). Code signing using a trusted certificate authority ensures that the code has not been tampered with since it was signed by the vendor.

Answer

Software License Agreement (SLA)

Answer

SHA-256 checksum published on a text file

Answer

Vendor SOC 2 Type II report

Question 4

An organization is concerned about 'Typosquatting' in their build system. Which strategy is most effective at preventing the accidental inclusion of malicious, similarly-named packages?

Accepted Answer

Configure an allowlist-only proxy repository.. Using a private proxy/repository that only allows an approved 'allowlist' of packages prevents developers from pulling typosquatted packages from public registries.

Answer

Rely on the developer's ability to check spelling.

Answer

Increase the frequency of penetration tests.

Answer

Enable two-factor authentication on developer accounts.

Question 5

You are auditing a third-party vendor's CI/CD pipeline integration. You notice they pull dependencies from public mirrors without pinning them to specific hashes. What is the primary security risk here?

Accepted Answer

Version hijacking due to lack of immutability.. Without hash pinning (e.g., package-lock.json or yarn.lock), an attacker can perform a 'version hijacking' attack by uploading a malicious version with the same semver string.

Answer

Incompatible library versions.

Answer

Excessive bandwidth usage.

Answer

Failure to meet license requirements.

Question 6

Your organization uses a 'Golden Image' approach for build containers. To prevent supply chain contamination of these build environments, what is the most effective security control?

Accepted Answer

Implement image signing and verification (e.g., Docker Content Trust or Cosign).. Using signed, immutable images from a private container registry ensures that build environments cannot be altered by unauthorized parties.

Answer

Disable all outbound network access from the build server.

Answer

Automatically pull the latest 'alpine' image during build time.

Answer

Rotate the build server SSH keys daily.

Question 7

You are setting up an automated policy in GitHub Actions to block builds that contain dependencies with known high-severity vulnerabilities. Which tool is standard for this type of automated gated check?

Accepted Answer

Snyk Open Source integration.. Snyk is widely used in CI/CD pipelines as a gatekeeper to block builds based on vulnerability thresholds.

Answer

GitHub Projects.

Answer

Git LFS.

Answer

GitHub Pages.

Question 8

Your development team is integrating a new third-party library via npm. To prevent dependency confusion attacks where a malicious package is pulled from a public registry instead of your internal private registry, which configuration should be applied?

Accepted Answer

Set the registry URL in the .npmrc file to point specifically to your internal Artifactory or Nexus scope.. Scoped registries in .npmrc ensure that packages within a specific scope are always fetched from the designated private registry, preventing the resolution of malicious public packages with the same name.

Answer

Run 'npm audit fix' before every build process.

Answer

Add the dependency to the 'bundledDependencies' array in package.json.

Answer

Enable 'strict-ssl' in the global npm configuration.

Question 9

You are using 'in-toto' to secure your software supply chain. What is the primary purpose of a 'layout' file in this framework?

Accepted Answer

To define the supply chain steps, actors, and expected artifacts.. The layout file specifies the authorized steps, the actors responsible for each step, and the expected artifacts, providing the policy for verifying the supply chain.

Answer

To encrypt the source code repository.

Answer

To generate the final SBOM document.

Answer

To list all CVEs found in the dependencies.

Question 10

What is the primary function of a 'Vulnerability Disclosure Policy' (VDP) in a vendor's secure development lifecycle?

Accepted Answer

Provide a secure channel for researchers to report vulnerabilities.. A VDP provides a standardized way for security researchers to report vulnerabilities, allowing the vendor to fix them before they are exploited in the wild.

Answer

Automate the patching of production servers.

Answer

Create a list of known hardware defects.

Answer

Legal protection against data breaches.

Question 11

You notice that your build server environment pulls Docker images from a public registry with the ':latest' tag. Why is this a major supply chain security flaw?

Accepted Answer

The tag is mutable, allowing an attacker to inject a malicious image.. The ':latest' tag is mutable; it can be overwritten by an attacker to point to a malicious image without the build system being aware of the change.

Answer

The tag prevents container layer caching.

Answer

The registry will throttle downloads of the ':latest' tag.

Answer

The tag is deprecated in favor of ':stable'.

Question 12

A supplier asks you to describe your 'Supply Chain Security Policy'. What is the most appropriate foundational element to include?

Accepted Answer

Requirement for an SBOM for all delivered software.. A secure supply chain policy must start with a requirement for software transparency, typically in the form of an SBOM for all delivered software.

Answer

Requirement for 100% code coverage in unit tests.

Answer

Requirement to use proprietary code only.

Answer

Requirement for the supplier to perform a full system wipe.

Question 13

When assessing a SaaS provider's supply chain, you are concerned about their 'Vendor Risk Management' (VRM) program. Which practice indicates a mature approach to fourth-party risk?

Accepted Answer

The vendor maintains an inventory of their critical fourth-party service providers.. A mature VRM program includes visibility into the vendor's sub-processors (fourth parties), as these are the vendors of your vendor, and represent a significant blind spot.

Answer

The vendor provides a generic privacy policy.

Answer

The vendor only uses software developed internally.

Answer

The vendor uses a public cloud provider.

Question 14

An organization is adopting the SLSA (Supply-chain Levels for Software Artifacts) framework. To achieve Level 3, what requirement must be met regarding the build platform?

Accepted Answer

The build platform must be hardened and provenance must be authenticated.. SLSA Level 3 requires the build platform to be 'hardened' and 'non-falsifiable', meaning the build integrity is protected and the provenance is cryptographically signed.

Answer

The code must be written in a memory-safe language.

Answer

The project must have 100% open-source components.

Answer

All developers must use a Linux-based OS.

Question 15

When performing a vendor security assessment for a new SaaS product, which THREE of the following should be requested to evaluate their supply chain resilience?

Accepted Answer

A list of critical fourth-party service providers (sub-processors).. Requesting an SBOM, a list of sub-processors (fourth parties), and evidence of automated dependency scanning are standard practices to assess third-party risk.

Answer

The vendor's employee handbook.

Answer

The vendor's annual financial report.

Question 16

To protect against a compromised build pipeline, which TWO of the following configurations should be implemented to ensure 'Hermetic Builds'?

Accepted Answer

Disable network access during the build process.. Hermetic builds require that all dependencies are declared and pinned, and that the build environment has no network access to avoid fetching unauthorized external dependencies.

Answer

Enable verbose logging to standard output.

Answer

Automatically pull the latest compiler version.

Answer

Allow developers to trigger manual builds via SSH.

Question 17

Which THREE of the following are common threats to the Software Supply Chain that an SBOM can help mitigate?

Accepted Answer

Identification of end-of-life (EOL) software components.. An SBOM allows for identifying vulnerable components (CVEs), managing end-of-life components, and identifying components with restrictive/incompatible licenses.

Answer

Mitigation of SQL injection flaws in custom code.

Answer

Prevention of brute-force attacks on application login.

Question 18

When designing an automated pipeline to prevent supply chain attacks, which THREE of the following features should be included in your artifact registry?

Accepted Answer

Automated vulnerability scanning of stored artifacts.. A secure registry should support immutable tags, vulnerability scanning of uploaded images, and Role-Based Access Control (RBAC) to control who can push/pull images.

Answer

Auto-scaling of the registry's storage capacity.

Answer

Automatic translation of code into multiple languages.

Question 19

Which TWO of the following are essential components of an effective Vendor Security Assessment program?

Accepted Answer

Review of third-party audit reports (e.g., SOC 2, ISO 27001).. Effective programs combine standardized assessment questionnaires with a review of objective evidence, such as third-party audit reports (SOC 2).

Answer

Physical inspection of the vendor's data center.

Answer

Mandatory integration of your internal tools with the vendor.

Answer

Requiring the vendor to use your internal developers.

Question 20

To defend against 'Dependency Confusion' attacks, which TWO of the following configurations should you apply to your private package manager?

Accepted Answer

Enable 'package shadowing' prevention or strict upstream filtering.. To prevent dependency confusion, you must configure the internal manager to prioritize internal namespaces (scopes) and forbid 'shadowing' by ensuring public packages cannot override internal ones.

Answer

Disable all caching of external packages.

Answer

Use the latest version of the CLI tool regardless of security patches.

Answer

Set the global registry to the public URL.