CSSLP Software Supply Chain Security Assessment

1. Which testing methodology is specifically designed to identify security vulnerabilities?

Unit testing

Integration testing

Security testing and penetration testing

Performance testing

2. Which of the following best describes secure dependency management?

Using any available third-party libraries without review

Regularly monitoring, updating, and assessing third-party components for vulnerabilities

Avoiding all external dependencies

Using outdated libraries to maintain stability

3. What is a key benefit of implementing DevSecOps in the software supply chain?

Slowing down development cycles

Integrating security practices throughout the entire development pipeline

Eliminating the need for testing

Removing security responsibility from developers

4. Which principle emphasizes building security into software from the beginning rather than adding it later?

Security as an afterthought

Security by design

Reactive security

Perimeter-only security

5. What is the role of security testing in the SDLC?

To delay project delivery

To identify and validate security controls and vulnerabilities

To replace all other quality assurance activities

To increase costs without benefits

6. Which secure coding practice protects against buffer overflow attacks?

Using unbounded string functions

Bounds checking and safe string handling

Disabling memory protection

Avoiding input validation

7. Secure configuration management in supply chains involves which of the following?

Documenting and controlling changes to software and environments

Ignoring version control

Using default configurations

Avoiding documentation

8. What is the purpose of a Software Bill of Materials (SBOM)?

To list project expenses

To document all software components, libraries, and dependencies

To track employee hours

To manage customer complaints

9. Which of the following is a common source of supply chain attacks?

Compromised build systems and repositories

User training programs

Office equipment

Customer satisfaction surveys

10. What does the principle of 'least privilege' mean in secure software design?

Users should have maximum access to all resources

Users should only have permissions necessary to perform their tasks

All access should be unrestricted

Security controls are unnecessary

11. Which phase of the Software Development Lifecycle (SDLC) focuses on identifying and documenting security requirements?

Requirements and Planning

Design

Implementation

Maintenance

12. What is the purpose of code review in the secure SDLC?

To ensure consistent code formatting only

To identify security vulnerabilities and coding flaws

To reduce the number of developers

To replace automated testing

13. Which of the following is a secure development practice for managing cryptographic keys?

Hardcoding keys in source code

Using key management systems and rotating keys regularly

Storing keys in version control systems

Using the same key for all applications

14. What is the primary purpose of Software Composition Analysis (SCA)?

To improve code readability

To identify and manage open-source components and their vulnerabilities

To increase application performance

To reduce documentation requirements

15. The concept of 'defense in depth' in software security means:

Using only one security layer

Implementing multiple overlapping security controls

Focusing security efforts on the perimeter only

Avoiding redundant security measures

16. Which secure coding practice prevents SQL injection attacks?

Using parameterized queries

Storing passwords in plaintext

Disabling error messages

Removing encryption

17. What does SLSA framework help to prevent in software supply chains?

User interface defects

Unauthorized changes and compromised artifacts

Network latency

Hardware failures

18. Supply chain risk in software development includes threats from which of the following sources?

Third-party libraries and components only

Development tools and build environments

Vendors, contractors, and open-source dependencies

Customer feedback alone

19. Which of the following is a key principle of secure coding?

Input validation and sanitization

Avoiding comments in code

Using global variables

Minimizing error handling

20. What is the primary goal of threat modeling in secure software development?

To eliminate all software bugs

To identify potential security threats and vulnerabilities

To reduce development costs

To accelerate time-to-market

CSSLP Software Supply Chain Security Quiz