You are implementing a Software Bill of Materials (SBOM) using the CycloneDX standard for your CI/CD pipeline. Which of the following fields is mandatory to uniquely identify an individual component within the SBOM to ensure accurate vulnerability tracking?
You are auditing a third-party vendor's CI/CD pipeline integration. You notice they pull dependencies from public mirrors without pinning them to specific hashes. What is the primary security risk here?
Your organization uses a 'Golden Image' approach for build containers. To prevent supply chain contamination of these build environments, what is the most effective security control?
During a vendor security assessment, you require a supplier to provide proof that their software is signed. Which mechanism should you verify to ensure the code's integrity and origin authenticity?
An organization is concerned about 'Typosquatting' in their build system. Which strategy is most effective at preventing the accidental inclusion of malicious, similarly-named packages?
You are setting up an automated policy in GitHub Actions to block builds that contain dependencies with known high-severity vulnerabilities. Which tool is standard for this type of automated gated check?
Your development team is integrating a new third-party library via npm. To prevent dependency confusion attacks where a malicious package is pulled from a public registry instead of your internal private registry, which configuration should be applied?
You notice that your build server environment pulls Docker images from a public registry with the ':latest' tag. Why is this a major supply chain security flaw?
When assessing a SaaS provider's supply chain, you are concerned about their 'Vendor Risk Management' (VRM) program. Which practice indicates a mature approach to fourth-party risk?
An organization is adopting the SLSA (Supply-chain Levels for Software Artifacts) framework. To achieve Level 3, what requirement must be met regarding the build platform?
When performing a vendor security assessment for a new SaaS product, which THREE of the following should be requested to evaluate their supply chain resilience?
When designing an automated pipeline to prevent supply chain attacks, which THREE of the following features should be included in your artifact registry?
A financial services firm mandates that every open-source component pulled into its build pipeline must carry a cryptographically signed provenance attestation from the original project maintainer. During a review, you discover that Sigstore's cosign verification succeeds, but the attestation was generated by an internal CI runner rather than the upstream maintainer. What is the most significant supply chain risk introduced by this configuration?
You are designing a secure software supply chain for a healthcare application that must comply with FDA premarket cybersecurity guidance. Your team proposes using the OWASP Dependency-Check tool within the CI pipeline to identify vulnerable third-party libraries. Which TWO additional practices are essential to establish a defensible component governance process that meets regulatory expectations? (Choose two.)
A software vendor provides a critical component to your organization. During contract negotiations, you request that the vendor provide a Software Bill of Materials (SBOM) for each release. The vendor agrees to provide a document listing all open-source libraries and their versions. Which additional attribute is most important to include in the SBOM to support rapid vulnerability response?
Your organization is adopting the SLSA framework to improve supply chain security. You are evaluating a build system that claims to meet SLSA level 3. During an assessment, you find that the build system generates provenance but does not sign it, and the provenance is stored on the same server that performs builds. Which SLSA level requirement is most directly violated by this finding?