Software Supply Chain Security.

SBOMs, artifact signing, SLSA framework, dependency attacks, and provenance. Covers 8 sub-skills.

• Software Supply Chain Security · 1 of 3

  License Compliance & SPDX

  What is the SPDX License Identifier for the MIT license?

  AMIT-LicenseBMIT-0CX11-MITDMIT

• Software Supply Chain Security · 2 of 3

  SBOMs (SPDX & CycloneDX)

  What identifier scheme does the SBOM ecosystem use to provide a universal, format-agnostic way to reference software packages?

  ACommon Platform Enumeration (CPE)BSoftware Identification Tag (SWID)CPackage URL (purl)DUniversal Resource Name (URN)

• Software Supply Chain Security · 3 of 3

  Dependency Confusion & Typosquatting

  Choosing between a 'verify SBOM + VEX at admission' policy and a 'verify SLSA provenance predicate at admission' policy for a regulated workload, what does the provenance check uniquely refuse?

  AAn artifact carrying a present component with a known unpatched CVE recordBAn artifact whose declared open-source license violates corporate policy rulesCAn artifact whose builder identity does not match the approved build workflowDAn artifact whose cumulative download count is below an internal threshold