Courseiva

CCNA Secure Software Supply Chain Questions

20 questions · Secure Software Supply Chain · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
Multi-Selectmedium

When designing an automated pipeline to prevent supply chain attacks, which THREE of the following features should be included in your artifact registry?

Select 3 answers
A.Auto-scaling of the registry's storage capacity.
B.Automatic translation of code into multiple languages.
C.Automated vulnerability scanning of stored artifacts.
D.Immutable tags (preventing overwriting of existing tags).
E.Granular Role-Based Access Control (RBAC).
AnswersC, D, E

Continuously identifies risks within the stored inventory.

Why this answer

A secure registry should support immutable tags, vulnerability scanning of uploaded images, and Role-Based Access Control (RBAC) to control who can push/pull images.

Practice this question →
2
MCQeasy

What is the primary function of a 'Vulnerability Disclosure Policy' (VDP) in a vendor's secure development lifecycle?

A.Provide a secure channel for researchers to report vulnerabilities.
B.Automate the patching of production servers.
C.Create a list of known hardware defects.
D.Legal protection against data breaches.
AnswerA

VDPs enable early detection and responsible disclosure.

Why this answer

A VDP provides a standardized way for security researchers to report vulnerabilities, allowing the vendor to fix them before they are exploited in the wild.

Practice this question →
3
MCQmedium

Your development team is integrating a new third-party library via npm. To prevent dependency confusion attacks where a malicious package is pulled from a public registry instead of your internal private registry, which configuration should be applied?

A.Set the registry URL in the .npmrc file to point specifically to your internal Artifactory or Nexus scope.
B.Run 'npm audit fix' before every build process.
C.Add the dependency to the 'bundledDependencies' array in package.json.
D.Enable 'strict-ssl' in the global npm configuration.
AnswerA

Scoped registries explicitly define where specific packages originate, mitigating dependency confusion.

Why this answer

Scoped registries in .npmrc ensure that packages within a specific scope are always fetched from the designated private registry, preventing the resolution of malicious public packages with the same name.

Practice this question →
4
MCQmedium

You notice that your build server environment pulls Docker images from a public registry with the ':latest' tag. Why is this a major supply chain security flaw?

A.The tag prevents container layer caching.
B.The tag is mutable, allowing an attacker to inject a malicious image.
C.The registry will throttle downloads of the ':latest' tag.
D.The tag is deprecated in favor of ':stable'.
AnswerB

Tag immutability is essential for security.

Why this answer

The ':latest' tag is mutable; it can be overwritten by an attacker to point to a malicious image without the build system being aware of the change.

Practice this question →
5
Multi-Selectmedium

To protect against a compromised build pipeline, which TWO of the following configurations should be implemented to ensure 'Hermetic Builds'?

Select 2 answers
A.Enable verbose logging to standard output.
B.Automatically pull the latest compiler version.
C.Disable network access during the build process.
D.Use pinned dependencies with cryptographic hashes.
E.Allow developers to trigger manual builds via SSH.
AnswersC, D

Prevents unauthorized fetching of dependencies or exfiltration.

Why this answer

Hermetic builds require that all dependencies are declared and pinned, and that the build environment has no network access to avoid fetching unauthorized external dependencies.

Practice this question →
6
Multi-Selectmedium

When performing a vendor security assessment for a new SaaS product, which THREE of the following should be requested to evaluate their supply chain resilience?

Select 3 answers
A.A list of critical fourth-party service providers (sub-processors).
B.The vendor's employee handbook.
C.The vendor's annual financial report.
D.Software Bill of Materials (SBOM) for the application.
E.Evidence of automated CI/CD dependency vulnerability scanning.
AnswersA, D, E

Crucial for identifying the extent of the vendor's supply chain.

Why this answer

Requesting an SBOM, a list of sub-processors (fourth parties), and evidence of automated dependency scanning are standard practices to assess third-party risk.

Practice this question →
7
MCQhard

An organization is adopting the SLSA (Supply-chain Levels for Software Artifacts) framework. To achieve Level 3, what requirement must be met regarding the build platform?

A.The code must be written in a memory-safe language.
B.The build platform must be hardened and provenance must be authenticated.
C.The project must have 100% open-source components.
D.All developers must use a Linux-based OS.
AnswerB

Non-falsifiable provenance is a core requirement of SLSA Level 3.

Why this answer

SLSA Level 3 requires the build platform to be 'hardened' and 'non-falsifiable', meaning the build integrity is protected and the provenance is cryptographically signed.

Practice this question →
8
MCQeasy

A supplier asks you to describe your 'Supply Chain Security Policy'. What is the most appropriate foundational element to include?

A.Requirement for 100% code coverage in unit tests.
B.Requirement to use proprietary code only.
C.Requirement for an SBOM for all delivered software.
D.Requirement for the supplier to perform a full system wipe.
AnswerC

Transparency is the baseline for third-party risk management.

Why this answer

A secure supply chain policy must start with a requirement for software transparency, typically in the form of an SBOM for all delivered software.

Practice this question →
9
MCQeasy

During a vendor security assessment, you require a supplier to provide proof that their software is signed. Which mechanism should you verify to ensure the code's integrity and origin authenticity?

A.Software License Agreement (SLA)
B.SHA-256 checksum published on a text file
C.Vendor SOC 2 Type II report
D.Digital Signature (e.g., Authenticode or GPG)
AnswerD

Digital signatures are the industry standard for verifying code integrity.

Why this answer

Code signing using a trusted certificate authority ensures that the code has not been tampered with since it was signed by the vendor.

Practice this question →
10
MCQmedium

You are setting up an automated policy in GitHub Actions to block builds that contain dependencies with known high-severity vulnerabilities. Which tool is standard for this type of automated gated check?

A.Snyk Open Source integration.
B.GitHub Projects.
C.Git LFS.
D.GitHub Pages.
AnswerA

Snyk provides build-time scanning and automated gating.

Why this answer

Snyk is widely used in CI/CD pipelines as a gatekeeper to block builds based on vulnerability thresholds.

Practice this question →
11
MCQeasy

When evaluating a vendor's open-source usage, which factor is the strongest indicator of a proactive security posture?

A.The vendor provides a static list of libraries once a year.
B.The vendor does not use any open-source software.
C.The vendor maintains a documented process for tracking and patching vulnerable components.
D.The vendor uses only the newest versions of all libraries.
AnswerC

Formal processes are the best indicator of long-term security maintenance.

Why this answer

A formal vulnerability disclosure program (VDP) and regular patching cycles demonstrate a vendor's commitment to managing third-party risks.

Practice this question →
12
Multi-Selecthard

Which THREE of the following are common threats to the Software Supply Chain that an SBOM can help mitigate?

Select 3 answers
A.Mitigation of SQL injection flaws in custom code.
B.Prevention of brute-force attacks on application login.
C.Identification of end-of-life (EOL) software components.
D.Identification of components with known CVEs.
E.Detection of non-compliant or restrictive open-source licenses.
AnswersC, D, E

Visibility into component versioning helps track obsolescence.

Why this answer

An SBOM allows for identifying vulnerable components (CVEs), managing end-of-life components, and identifying components with restrictive/incompatible licenses.

Practice this question →
13
MCQmedium

Your organization uses a 'Golden Image' approach for build containers. To prevent supply chain contamination of these build environments, what is the most effective security control?

A.Implement image signing and verification (e.g., Docker Content Trust or Cosign).
B.Disable all outbound network access from the build server.
C.Automatically pull the latest 'alpine' image during build time.
D.Rotate the build server SSH keys daily.
AnswerA

Signing and verifying images guarantees that the container running the build is exactly what was approved.

Why this answer

Using signed, immutable images from a private container registry ensures that build environments cannot be altered by unauthorized parties.

Practice this question →
14
Multi-Selecthard

To defend against 'Dependency Confusion' attacks, which TWO of the following configurations should you apply to your private package manager?

Select 2 answers
A.Disable all caching of external packages.
B.Use the latest version of the CLI tool regardless of security patches.
C.Set the global registry to the public URL.
D.Enable 'package shadowing' prevention or strict upstream filtering.
E.Explicitly configure scope-to-registry mappings.
AnswersD, E

Ensures public registries cannot provide packages that match internal names.

Why this answer

To prevent dependency confusion, you must configure the internal manager to prioritize internal namespaces (scopes) and forbid 'shadowing' by ensuring public packages cannot override internal ones.

Practice this question →
15
MCQhard

You are auditing a third-party vendor's CI/CD pipeline integration. You notice they pull dependencies from public mirrors without pinning them to specific hashes. What is the primary security risk here?

A.Incompatible library versions.
B.Excessive bandwidth usage.
C.Version hijacking due to lack of immutability.
D.Failure to meet license requirements.
AnswerC

Lockfiles ensure that the exact byte-for-byte code is used in every build.

Why this answer

Without hash pinning (e.g., package-lock.json or yarn.lock), an attacker can perform a 'version hijacking' attack by uploading a malicious version with the same semver string.

Practice this question →
16
MCQmedium

You are using 'in-toto' to secure your software supply chain. What is the primary purpose of a 'layout' file in this framework?

A.To encrypt the source code repository.
B.To generate the final SBOM document.
C.To list all CVEs found in the dependencies.
D.To define the supply chain steps, actors, and expected artifacts.
AnswerD

The layout serves as the source of truth for verification.

Why this answer

The layout file specifies the authorized steps, the actors responsible for each step, and the expected artifacts, providing the policy for verifying the supply chain.

Practice this question →
17
MCQhard

An organization is concerned about 'Typosquatting' in their build system. Which strategy is most effective at preventing the accidental inclusion of malicious, similarly-named packages?

A.Rely on the developer's ability to check spelling.
B.Configure an allowlist-only proxy repository.
C.Increase the frequency of penetration tests.
D.Enable two-factor authentication on developer accounts.
AnswerB

If it is not on the allowlist, it cannot be downloaded.

Why this answer

Using a private proxy/repository that only allows an approved 'allowlist' of packages prevents developers from pulling typosquatted packages from public registries.

Practice this question →
18
MCQhard

You are implementing a Software Bill of Materials (SBOM) using the CycloneDX standard for your CI/CD pipeline. Which of the following fields is mandatory to uniquely identify an individual component within the SBOM to ensure accurate vulnerability tracking?

A.hash-algorithm
B.author-email
C.license-id
D.purl
AnswerD

purl provides the standardized format for component identification.

Why this answer

The purl (Package URL) is the standard identifier in CycloneDX for mapping components to vulnerability databases like the NVD.

Practice this question →
19
Multi-Selecteasy

Which TWO of the following are essential components of an effective Vendor Security Assessment program?

Select 2 answers
A.Physical inspection of the vendor's data center.
B.Mandatory integration of your internal tools with the vendor.
C.Review of third-party audit reports (e.g., SOC 2, ISO 27001).
D.Standardized vendor security questionnaires.
E.Requiring the vendor to use your internal developers.
AnswersC, D

Leverages independent verification of security controls.

Why this answer

Effective programs combine standardized assessment questionnaires with a review of objective evidence, such as third-party audit reports (SOC 2).

Practice this question →
20
MCQhard

When assessing a SaaS provider's supply chain, you are concerned about their 'Vendor Risk Management' (VRM) program. Which practice indicates a mature approach to fourth-party risk?

A.The vendor provides a generic privacy policy.
B.The vendor maintains an inventory of their critical fourth-party service providers.
C.The vendor only uses software developed internally.
D.The vendor uses a public cloud provider.
AnswerB

Managing fourth-party risk is a hallmark of mature supply chain security.

Why this answer

A mature VRM program includes visibility into the vendor's sub-processors (fourth parties), as these are the vendors of your vendor, and represent a significant blind spot.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Secure Software Supply Chain questions.

Start 20-question session