CSSLP Secure Software Supply Chain — Timed 15 Questions

Question 1

You are implementing a Software Bill of Materials (SBOM) using the CycloneDX standard for your CI/CD pipeline. Which of the following fields is mandatory to uniquely identify an individual component within the SBOM to ensure accurate vulnerability tracking?

15 minute time limit — choose an answer to begin.

Accepted Answer

purl. In CycloneDX, the Package URL (purl) is the mandatory, standardized identifier that uniquely locates a component across ecosystems (e.g., pkg:maven/org.apache/log4j@2.14.1). It enables tools to correlate SBOM entries with vulnerability databases like OSV or NVD, making accurate tracking possible. Without purl, components cannot be reliably matched to advisories.

Answer

hash-algorithm

Answer

author-email

Answer

license-id

Question 2

You are auditing a third-party vendor's CI/CD pipeline integration. You notice they pull dependencies from public mirrors without pinning them to specific hashes. What is the primary security risk here?

Accepted Answer

Version hijacking due to lack of immutability.. The primary risk is that without pinning dependencies to specific cryptographic hashes, the build process may fetch a different artifact than intended, allowing an attacker to substitute a malicious package (a supply chain attack). This is often called version hijacking or dependency confusion, and it violates the principle of immutability—the guarantee that a given version always resolves to the same bits. In CI/CD, immutability ensures reproducibility and integrity, so unpinned dependencies break that guarantee and open the door to code injection.

Answer

Incompatible library versions.

Answer

Excessive bandwidth usage.

Answer

Failure to meet license requirements.

Question 3

Your organization uses a 'Golden Image' approach for build containers. To prevent supply chain contamination of these build environments, what is the most effective security control?

Accepted Answer

Implement image signing and verification (e.g., Docker Content Trust or Cosign).. Using signed, immutable images from a private container registry ensures that build environments cannot be altered by unauthorized parties.

Answer

Disable all outbound network access from the build server.

Answer

Automatically pull the latest 'alpine' image during build time.

Answer

Rotate the build server SSH keys daily.

Question 4

To defend against 'Dependency Confusion' attacks, which TWO of the following configurations should you apply to your private package manager?

Accepted Answer

Enable 'package shadowing' prevention or strict upstream filtering.. To prevent dependency confusion, you must configure the internal manager to prioritize internal namespaces (scopes) and forbid 'shadowing' by ensuring public packages cannot override internal ones.

Answer

Disable all caching of external packages.

Answer

Use the latest version of the CLI tool regardless of security patches.

Answer

Set the global registry to the public URL.

Question 5

When evaluating a vendor's open-source usage, which factor is the strongest indicator of a proactive security posture?

Accepted Answer

The vendor maintains a documented process for tracking and patching vulnerable components.. A documented process for tracking and patching vulnerable components demonstrates an ongoing, repeatable capability to identify and remediate open-source vulnerabilities, which is the hallmark of a proactive security posture. It shows the vendor monitors advisories (e.g., CVEs, NVD, GitHub Security Advisories), maintains an SBOM, and has SLAs for patching. Static lists or version freshness alone do not prove the vendor can respond to newly disclosed vulnerabilities.

Answer

The vendor provides a static list of libraries once a year.

Answer

The vendor does not use any open-source software.

Answer

The vendor uses only the newest versions of all libraries.

Question 6

During a vendor security assessment, you require a supplier to provide proof that their software is signed. Which mechanism should you verify to ensure the code's integrity and origin authenticity?

Accepted Answer

Digital Signature (e.g., Authenticode or GPG). A digital signature (e.g., Authenticode on Windows, GPG on Linux) uses asymmetric cryptography to provide both integrity and origin authenticity. The vendor signs the code with its private key; you verify with the vendor's public key, confirming the code has not been tampered with and genuinely came from that vendor. This is the only mechanism in the list that proves both integrity and origin.

Answer

Software License Agreement (SLA)

Answer

SHA-256 checksum published on a text file

Answer

Vendor SOC 2 Type II report

Question 7

An organization is concerned about 'Typosquatting' in their build system. Which strategy is most effective at preventing the accidental inclusion of malicious, similarly-named packages?

Accepted Answer

Configure an allowlist-only proxy repository.. An allowlist-only proxy repository permits only explicitly approved packages (by name, version, and hash) to be fetched, so a malicious package with a similar name (e.g., 'reqeusts' instead of 'requests') is rejected even if a developer mistypes it. This is the most effective technical control because it removes reliance on human vigilance and blocks the attack at the dependency-resolution layer.

Answer

Rely on the developer's ability to check spelling.

Answer

Increase the frequency of penetration tests.

Answer

Enable two-factor authentication on developer accounts.

Question 8

You are setting up an automated policy in GitHub Actions to block builds that contain dependencies with known high-severity vulnerabilities. Which tool is standard for this type of automated gated check?

Accepted Answer

Snyk Open Source integration.. Snyk is widely used in CI/CD pipelines as a gatekeeper to block builds based on vulnerability thresholds.

Answer

GitHub Projects.

Answer

Git LFS.

Answer

GitHub Pages.

Question 9

Your development team is integrating a new third-party library via npm. To prevent dependency confusion attacks where a malicious package is pulled from a public registry instead of your internal private registry, which configuration should be applied?

Accepted Answer

Set the registry URL in the .npmrc file to point specifically to your internal Artifactory or Nexus scope.. Scoped registries in .npmrc ensure that packages within a specific scope are always fetched from the designated private registry, preventing the resolution of malicious public packages with the same name.

Answer

Run 'npm audit fix' before every build process.

Answer

Add the dependency to the 'bundledDependencies' array in package.json.

Answer

Enable 'strict-ssl' in the global npm configuration.

Question 10

You are using 'in-toto' to secure your software supply chain. What is the primary purpose of a 'layout' file in this framework?

Accepted Answer

To define the supply chain steps, actors, and expected artifacts.. The layout file specifies the authorized steps, the actors responsible for each step, and the expected artifacts, providing the policy for verifying the supply chain.

Answer

To encrypt the source code repository.

Answer

To generate the final SBOM document.

Answer

To list all CVEs found in the dependencies.

Question 11

What is the primary function of a 'Vulnerability Disclosure Policy' (VDP) in a vendor's secure development lifecycle?

Accepted Answer

Provide a secure channel for researchers to report vulnerabilities.. A Vulnerability Disclosure Policy (VDP) defines how external security researchers can report vulnerabilities to an organization, specifying the scope, reporting channel, and safe harbor terms. Its primary function is to provide a clear, secure, and legal channel for receiving vulnerability reports so they can be triaged and remediated. It is a foundational element of coordinated vulnerability disclosure (CVD) and is distinct from bug bounty programs, which add incentives.

Answer

Automate the patching of production servers.

Answer

Create a list of known hardware defects.

Answer

Legal protection against data breaches.

Question 12

You notice that your build server environment pulls Docker images from a public registry with the ':latest' tag. Why is this a major supply chain security flaw?

Accepted Answer

The tag is mutable, allowing an attacker to inject a malicious image.. The ':latest' tag is a mutable pointer, not a fixed version identifier. When a build server pulls 'image:latest', it retrieves whatever image the registry currently associates with that tag, which may differ from the image previously tested or approved. An attacker who compromises the upstream repository or registry account can push a malicious image under ':latest', and the next build will silently consume it — a classic software supply chain attack.

Answer

The tag prevents container layer caching.

Answer

The registry will throttle downloads of the ':latest' tag.

Answer

The tag is deprecated in favor of ':stable'.

Question 13

A supplier asks you to describe your 'Supply Chain Security Policy'. What is the most appropriate foundational element to include?

Accepted Answer

Requirement for an SBOM for all delivered software.. A secure supply chain policy must start with a requirement for software transparency, typically in the form of an SBOM for all delivered software.

Answer

Requirement for 100% code coverage in unit tests.

Answer

Requirement to use proprietary code only.

Answer

Requirement for the supplier to perform a full system wipe.

Question 14

When assessing a SaaS provider's supply chain, you are concerned about their 'Vendor Risk Management' (VRM) program. Which practice indicates a mature approach to fourth-party risk?

Accepted Answer

The vendor maintains an inventory of their critical fourth-party service providers.. A mature VRM program includes visibility into the vendor's sub-processors (fourth parties), as these are the vendors of your vendor, and represent a significant blind spot.

Answer

The vendor provides a generic privacy policy.

Answer

The vendor only uses software developed internally.

Answer

The vendor uses a public cloud provider.

Question 15

An organization is adopting the SLSA (Supply-chain Levels for Software Artifacts) framework. To achieve Level 3, what requirement must be met regarding the build platform?

Accepted Answer

The build platform must be hardened and provenance must be authenticated.. SLSA Level 3 requires the build platform to be 'hardened' and 'non-falsifiable', meaning the build integrity is protected and the provenance is cryptographically signed.

Answer

The code must be written in a memory-safe language.

Answer

The project must have 100% open-source components.

Answer

All developers must use a Linux-based OS.