CSSLP Secure Software Supply Chain Practice Question
Your development team is integrating a new third-party library via npm. To prevent dependency confusion attacks where a malicious package is pulled from a public registry instead of your internal private registry, which configuration should be applied?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the registry URL in the .npmrc file to point specifically to your internal Artifactory or Nexus scope.
Scoped registries in .npmrc ensure that packages within a specific scope are always fetched from the designated private registry, preventing the resolution of malicious public packages with the same name.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set the registry URL in the .npmrc file to point specifically to your internal Artifactory or Nexus scope.
Why this is correct
Scoped registries explicitly define where specific packages originate, mitigating dependency confusion.
- ✗
Run 'npm audit fix' before every build process.
Why it's wrong here
npm audit fix is for patching known vulnerabilities, not preventing registry poisoning.
- ✗
Add the dependency to the 'bundledDependencies' array in package.json.
Why it's wrong here
bundledDependencies is for bundling packages in the distribution, not for registry scoping.
- ✗
Enable 'strict-ssl' in the global npm configuration.
Why it's wrong here
strict-ssl only ensures secure transport, not origin authenticity.
About these practice questions
This CSSLP question is part of Courseiva's 198-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official (ISC)² exam blueprint
This CSSLP practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CSSLP exam.