Secure CI/CD Quiz Answer Key
Table of Contents
Compare your choices with these explanations. Mark each miss and explain the correction without copying the key. Score at least eight on a closed-book attempt and correct every miss before the capstone.
- B. A direct change may pull new transitive code into the build.
- C. An empty interface does not prove the dependency set is safe.
- B. Record the scan target and scanner version. An SBOM is an inventory, not a safety certificate.
- A. Read access supports checkout without granting publication authority.
- B. Untrusted code in a privileged job may use its token or secrets.
- C. Missing evidence needs a separate decision.
- C. The attacker may replace both artifact and checksum.
- B. Signature validity does not override the expected source policy.
- D. SLSA levels include build platform and provenance requirements.
- C. A failed integrity gate should block release and preserve the observed digest.
Record and Repair Your Score
Write score: X/10 and list every missed question in your course record. At least eight correct on a closed-book attempt plus a corrected explanation for every miss meet the quiz threshold. Retake the full quiz after review if your first score is lower. Use the lesson map to repair a weak area:
| Questions | Review |
|---|---|
| 1 to 3 | Dependency review and SBOMs |
| 4 to 6 | Pipeline permissions and Scorecard |
| 7 to 9 | Provenance and attestations |
| 10 | Tampered release lab |
For each miss, write the unsafe choice, the correct decision, and the evidence needed in a real release. Then answer the missed question again without viewing this key. Record the second answer and link the lesson section used. If the second answer is still wrong, repeat the related lab step or source check before starting the capstone.
Troubleshooting
- A score differs from your record: Recount the ten original choices before using corrected answers.
- Two options still seem plausible: State what each option proves, then choose the one matching the question’s required evidence.
- A lab question lacks a result: Run the local tampered-release fixture again and record the exit code.
Verify Completion
- Latest closed-book score is at least eight, with missed question numbers recorded
- Every miss has a corrected rule and lesson link
- Missed questions are answered again without the key
- The latest closed-book attempt scores at least eight, and every miss has been repaired before the capstone
Next: Complete the release gate capstone .
