- A
Generate an SBOM for each application
Why wrong: SBOM documents dependencies but does not prevent dependency confusion.
- B
Use verified publisher names in the public registry
Correct. Verified publishers help ensure authenticity.
- C
Sign all internal packages with a private key
Why wrong: Signing ensures integrity but does not prevent pulling from public.
- D
Use scoped packages (e.g., @company/package-name)
Correct. Scoped namespaces reduce naming collisions.
- E
Configure the package manager to prefer the private registry over public
Correct. This prevents pulling from public by mistake.
Question 365 of 1,000
CCSP Cloud Application Security Practice Question
This CCSP practice question tests your understanding of cloud application security. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses a private artifact registry for internal packages. An attacker could perform a dependency confusion attack by uploading a malicious package to a public registry with the same name as an internal package. Which THREE measures help mitigate this attack?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use verified publisher names in the public registry
Option B is correct because verified publisher names in a public registry (e.g., npm verified publishers or PyPI trusted publishers) allow the package manager to cryptographically verify that a package was published by a trusted identity. This prevents an attacker from impersonating an internal package name, as the malicious upload would lack the verified publisher claim and be rejected during resolution.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Generate an SBOM for each application
Why it's wrong here
SBOM documents dependencies but does not prevent dependency confusion.
- ✓
Use verified publisher names in the public registry
Why this is correct
Correct. Verified publishers help ensure authenticity.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Sign all internal packages with a private key
Why it's wrong here
Signing ensures integrity but does not prevent pulling from public.
- ✓
Use scoped packages (e.g., @company/package-name)
Why this is correct
Correct. Scoped namespaces reduce naming collisions.
Related concept
Read the scenario before looking for a memorised answer.
- ✓
Configure the package manager to prefer the private registry over public
Why this is correct
Correct. This prevents pulling from public by mistake.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the misconception that signing packages alone prevents dependency confusion, but signature verification only protects integrity after download, not the resolution order that causes the attack.
Trap categories for this question
Similar concept trap
SBOM documents dependencies but does not prevent dependency confusion.
Detailed technical explanation
How to think about this question
Dependency confusion exploits the package manager's default resolution order, where public registries are often checked before private ones. Scoped packages (e.g., @company/package-name) create a unique namespace that public registries cannot conflict with, as the scope is tied to the organization. Verified publisher names leverage OIDC-based trust (e.g., npm's `publishConfig` with `access: public` and verified GitHub orgs) to bind package ownership to a specific entity, making it impossible for an attacker to claim the same publisher identity without compromising the trusted CI/CD pipeline.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A developer is choosing between AES-256 (symmetric) and RSA-2048 (asymmetric) for encrypting a large file that will be sent to a partner. Symmetric encryption is fast but requires key exchange; asymmetric is slower but solves the key distribution problem. A hybrid approach — encrypt the file with AES, encrypt the AES key with RSA — is standard. Questions like this test whether you understand when each approach applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Cloud Application Security — study guide chapter
Learn the concepts, then practise the questions
- →
Cloud Application Security practice questions
Targeted practice on this topic area only
- →
All CCSP questions
1,000 questions across all exam domains
- →
Certified Cloud Security Professional CCSP study guide
Full concept coverage aligned to exam objectives
- →
CCSP practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related CCSP practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Cloud Platform and Infrastructure Security practice questions
Practise CCSP questions linked to Cloud Platform and Infrastructure Security.
Cloud Security Operations practice questions
Practise CCSP questions linked to Cloud Security Operations.
Legal, Risk, and Compliance practice questions
Practise CCSP questions linked to Legal, Risk, and Compliance.
Legal, Risk and Compliance practice questions
Practise CCSP questions linked to Legal, Risk and Compliance.
Cloud Data Security practice questions
Practise CCSP questions linked to Cloud Data Security.
Cloud Concepts, Architecture, and Design practice questions
Practise CCSP questions linked to Cloud Concepts, Architecture, and Design.
Cloud Application Security practice questions
Practise CCSP questions linked to Cloud Application Security.
Cloud Concepts, Architecture and Design practice questions
Practise CCSP questions linked to Cloud Concepts, Architecture and Design.
CCSP fundamentals practice questions
Practise CCSP questions linked to CCSP fundamentals.
CCSP scenario practice questions
Practise CCSP questions linked to CCSP scenario.
CCSP troubleshooting practice questions
Practise CCSP questions linked to CCSP troubleshooting.
Practice this exam
Start a free CCSP practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this CCSP question test?
Cloud Application Security — This question tests Cloud Application Security — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Use verified publisher names in the public registry — Option B is correct because verified publisher names in a public registry (e.g., npm verified publishers or PyPI trusted publishers) allow the package manager to cryptographically verify that a package was published by a trusted identity. This prevents an attacker from impersonating an internal package name, as the malicious upload would lack the verified publisher claim and be rejected during resolution.
What should I do if I get this CCSP question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jul 4, 2026
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.