Practice SBOM pipeline vocabulary: generating SBOMs at build time, SBOM-based vulnerability scanning, supply chain compliance, and CycloneDX vs SPDX format language.
0 / 22 completed
1 / 22
What is an SBOM (Software Bill of Materials)?
An SBOM is a formal, machine-readable list of all components in a piece of software — open-source libraries, commercial components, and their versions. It enables vulnerability scanning, licence compliance checking, and supply chain risk management.
2 / 22
When is the ideal time to generate an SBOM in a CI/CD pipeline?
Generating the SBOM at build time captures the exact set of dependencies used to create the artifact. An SBOM generated at build time is deterministic and can be attached to the artifact (e.g., container image) for downstream verification.
3 / 22
What does 'vulnerability scan against SBOM' mean?
SBOM-based vulnerability scanning takes the component inventory and checks each entry against vulnerability databases. This is faster and more accurate than ad-hoc dependency scanning because the SBOM provides an authoritative list of what's in the software.
4 / 22
What is the difference between CycloneDX and SPDX?
SPDX (Software Package Data Exchange) was created by the Linux Foundation for licence compliance. CycloneDX was created by OWASP with security use cases in mind. Both are now widely accepted SBOM standards; CycloneDX is generally preferred in DevSecOps tooling.
5 / 22
A compliance requirement states 'an ___ is required for software supply chain compliance.' What acronym fits?
US Executive Order 14028 (2021) and subsequent regulations require SBOMs for software sold to government agencies. An SBOM provides the transparency needed to verify supply chain integrity and identify vulnerable components across an organisation's software portfolio.
6 / 22
PR Description:
"Implemented automated SBOM generation as part of the deployment pipeline. This ensures traceability of all dependencies and supports ongoing compliance efforts. We've integrated it with our vulnerability scanning tool to proactively identify potential risks."
Option 2 is correct because an SBOM generated during deployment only represents the state of the software at that specific point in time. A static SBOM doesn't account for changes made after generation. Vulnerability scans need a current view of dependencies to accurately identify risks. Options 1 and 4 are incorrect as they suggest the SBOM provides continuous accuracy or solely focuses on auditing, respectively – both misinterpretations.
7 / 22
During a Slack conversation with the security team about a recent vulnerability alert in our core application, Mark says: 'We're seeing a lot of reports about outdated libraries. I think we should run a scan against all our deployed artifacts to identify where these vulnerabilities are originating.' Which action best reflects Mark's suggestion regarding SBOM usage?
Mark's suggestion highlights the importance of using an SBOM as a central source of truth for dependencies. An SBOM allows you to precisely map vulnerabilities discovered in a scan back to specific deployed artifacts – in this case, microservices – enabling targeted remediation efforts rather than a blanket patching strategy. Option A is overly simplistic and ignores dependency constraints; option C dismisses valuable data; and option D is an inefficient approach.
8 / 22
During a standup update, Alex reports on the progress of integrating SBOM generation into the CI/CD pipeline. He explains: 'We've successfully automated the creation of an SBOM using the SBOMGeneratorTool CLI and storing it in our artifact repository. Now, we need to ensure our vulnerability scanner can access this SBOM efficiently.' Which statement best describes the next crucial step for Alex and his team?
Option A: Implement a manual process to upload the SBOM file to the vulnerability scanner's configuration. Option B: Configure the vulnerability scanner to automatically fetch the SBOM from the artifact repository using its API endpoint https://api.example.com/sbom/. Option C: Generate a static report of vulnerabilities and distribute it to development teams. Option D: Prioritize achieving full regulatory compliance over operational efficiency, dedicating significant resources to manual SBOM validation.
The correct answer is B because automating the retrieval of the SBOM from the artifact repository via its API is the most efficient and scalable approach for integrating with a vulnerability scanner. Options A and C represent inefficient or incomplete solutions. Option D highlights an overly restrictive prioritization that would hinder automation.
9 / 22
PR Description:
"Implemented automated SBOM generation as part of the deployment pipeline. This ensures traceability of all dependencies and supports ongoing compliance efforts. We've integrated it with our vulnerability scanning tool to proactively identify potential risks."
Option 2 is correct because an SBOM generated during deployment only represents the state of the software at that specific point in time. A static SBOM doesn't account for changes made after generation. Vulnerability scans need a current view of dependencies to accurately identify risks. Options 1 and 4 are incorrect as they suggest the SBOM provides continuous accuracy or solely focuses on auditing, respectively – both misinterpretations.
10 / 22
During a Slack conversation with the security team about a recent vulnerability alert in our core application, Mark says: 'We're seeing a lot of reports about outdated libraries. I think we should run a scan against all our deployed artifacts to identify where these vulnerabilities are originating.' Which action best reflects Mark's suggestion regarding SBOM usage?
Mark's suggestion highlights the importance of using an SBOM as a central source of truth for dependencies. An SBOM allows you to precisely map vulnerabilities discovered in a scan back to specific deployed artifacts – in this case, microservices – enabling targeted remediation efforts rather than a blanket patching strategy. Option A is overly simplistic and ignores dependency constraints; option C dismisses valuable data; and option D is an inefficient approach.
11 / 22
During a standup update, Alex reports on the progress of integrating SBOM generation into the CI/CD pipeline. He explains: 'We've successfully automated the creation of an SBOM using the SBOMGeneratorTool CLI and storing it in our artifact repository. Now, we need to ensure our vulnerability scanner can access this SBOM efficiently.' Which statement best describes the next crucial step for Alex and his team?
Option A: Implement a manual process to upload the SBOM file to the vulnerability scanner's configuration. Option B: Configure the vulnerability scanner to automatically fetch the SBOM from the artifact repository using its API endpoint https://api.example.com/sbom/. Option C: Generate a static report of vulnerabilities and distribute it to development teams. Option D: Prioritize achieving full regulatory compliance over operational efficiency, dedicating significant resources to manual SBOM validation.
The correct answer is B because automating the retrieval of the SBOM from the artifact repository via its API is the most efficient and scalable approach for integrating with a vulnerability scanner. Options A and C represent inefficient or incomplete solutions. Option D highlights an overly restrictive prioritization that would hinder automation.
12 / 22
PR Description:
"Implemented automated SBOM generation as part of the deployment pipeline. This ensures traceability of all dependencies and supports ongoing compliance efforts. We've integrated it with our vulnerability scanning tool to proactively identify potential risks."
Option 2 is correct because an SBOM generated during deployment only represents the state of the software at that specific point in time. A static SBOM doesn't account for changes made after generation. Vulnerability scans need a current view of dependencies to accurately identify risks. Options 1 and 4 are incorrect as they suggest the SBOM provides continuous accuracy or solely focuses on auditing, respectively – both misinterpretations.
13 / 22
During a Slack conversation with the security team about a recent vulnerability alert in our core application, Mark says: 'We're seeing a lot of reports about outdated libraries. I think we should run a scan against all our deployed artifacts to identify where these vulnerabilities are originating.' Which action best reflects Mark's suggestion regarding SBOM usage?
Mark's suggestion highlights the importance of using an SBOM as a central source of truth for dependencies. An SBOM allows you to precisely map vulnerabilities discovered in a scan back to specific deployed artifacts – in this case, microservices – enabling targeted remediation efforts rather than a blanket patching strategy. Option A is overly simplistic and ignores dependency constraints; option C dismisses valuable data; and option D is an inefficient approach.
14 / 22
During a standup update, Alex reports on the progress of integrating SBOM generation into the CI/CD pipeline. He explains: 'We've successfully automated the creation of an SBOM using the SBOMGeneratorTool CLI and storing it in our artifact repository. Now, we need to ensure our vulnerability scanner can access this SBOM efficiently.' Which statement best describes the next crucial step for Alex and his team?
Option A: Implement a manual process to upload the SBOM file to the vulnerability scanner's configuration. Option B: Configure the vulnerability scanner to automatically fetch the SBOM from the artifact repository using its API endpoint https://api.example.com/sbom/. Option C: Generate a static report of vulnerabilities and distribute it to development teams. Option D: Prioritize achieving full regulatory compliance over operational efficiency, dedicating significant resources to manual SBOM validation.
The correct answer is B because automating the retrieval of the SBOM from the artifact repository via its API is the most efficient and scalable approach for integrating with a vulnerability scanner. Options A and C represent inefficient or incomplete solutions. Option D highlights an overly restrictive prioritization that would hinder automation.
15 / 22
PR Description:
"Implemented automated SBOM generation as part of the deployment pipeline. This ensures traceability of all dependencies and supports ongoing compliance efforts. We've integrated it with our vulnerability scanning tool to proactively identify potential risks."
Option 2 is correct because an SBOM generated during deployment only represents the state of the software at that specific point in time. A static SBOM doesn't account for changes made after generation. Vulnerability scans need a current view of dependencies to accurately identify risks. Options 1 and 4 are incorrect as they suggest the SBOM provides continuous accuracy or solely focuses on auditing, respectively – both misinterpretations.
16 / 22
During a Slack conversation with the security team about a recent vulnerability alert in our core application, Mark says: 'We're seeing a lot of reports about outdated libraries. I think we should run a scan against all our deployed artifacts to identify where these vulnerabilities are originating.' Which action best reflects Mark's suggestion regarding SBOM usage?
Mark's suggestion highlights the importance of using an SBOM as a central source of truth for dependencies. An SBOM allows you to precisely map vulnerabilities discovered in a scan back to specific deployed artifacts – in this case, microservices – enabling targeted remediation efforts rather than a blanket patching strategy. Option A is overly simplistic and ignores dependency constraints; option C dismisses valuable data; and option D is an inefficient approach.
17 / 22
During a standup update, Alex reports on the progress of integrating SBOM generation into the CI/CD pipeline. He explains: 'We've successfully automated the creation of an SBOM using the SBOMGeneratorTool CLI and storing it in our artifact repository. Now, we need to ensure our vulnerability scanner can access this SBOM efficiently.' Which statement best describes the next crucial step for Alex and his team?
Option A: Implement a manual process to upload the SBOM file to the vulnerability scanner's configuration. Option B: Configure the vulnerability scanner to automatically fetch the SBOM from the artifact repository using its API endpoint https://api.example.com/sbom/. Option C: Generate a static report of vulnerabilities and distribute it to development teams. Option D: Prioritize achieving full regulatory compliance over operational efficiency, dedicating significant resources to manual SBOM validation.
The correct answer is B because automating the retrieval of the SBOM from the artifact repository via its API is the most efficient and scalable approach for integrating with a vulnerability scanner. Options A and C represent inefficient or incomplete solutions. Option D highlights an overly restrictive prioritization that would hinder automation.
18 / 22
During a code review session, Alice comments: 'I'm seeing that this deployment includes an SBOM generated by the SBOMGeneratorTool CLI. It seems like we should be validating that it accurately reflects all dependencies in our project.' Which of the following best describes the purpose of this SBOM generation within the CI/CD pipeline?
The SBOM is a detailed record of software components and their interrelationships, used for verification and compliance.
An SBOM (Software Bill of Materials) is a crucial artifact for supply chain security and compliance. Generating it automatically in the CI/CD pipeline allows for verification that all components are included, not deployment or monitoring.
19 / 22
Mark, a DevOps engineer, is explaining the SBOM process to a new team member. He says: 'We're using CycloneDX to create our SBOMs because it's an open standard and widely supported.' What is the primary reason for choosing CycloneDX over other SBOM formats like SPDX?
CycloneDX emphasizes machine readability and interoperability, facilitating automated analysis and reporting.
CycloneDX is favored because it's designed for machine consumption – enabling automated vulnerability scanning and dependency analysis. SPDX is more focused on human readability and standardization of metadata.
20 / 22
"Our compliance team requires an SBOM to be generated as part of our deployment process. Which command would you use to initiate this automatically from the CI/CD pipeline?"
SBOMGeneratorTool CLI generate --output
The prompt specifies a command to *generate* an SBOM. The provided `SBOMGeneratorTool CLI generate --output ` is the correct command for this purpose; the other options represent deployment or infrastructure management commands.
21 / 22
Sarah, a security analyst, receives an email from the vulnerability scanner. The subject line reads: 'High Severity Vulnerability Detected in SBOM for Project Phoenix.' What does this email *primarily* indicate?
The SBOM itself contains vulnerabilities or inaccuracies that need to be addressed.
An SBOM contains information about *dependencies*. A 'High Severity Vulnerability Detected in SBOM' means the SBOM itself (the list of components) may contain outdated or vulnerable libraries, triggering a need for remediation.
22 / 22
"We're implementing automated SBOM generation to improve our software supply chain risk management. What is the *most* important benefit of this approach?"
By providing a complete and verifiable record of all components, we can quickly identify and respond to potential vulnerabilities or security risks.
The core value of SBOMs is to enable proactive risk management. A verifiable record allows rapid vulnerability identification and compliance validation – the other options represent secondary benefits.
What does the "SBOM in CI/CD Pipeline Vocabulary" exercise cover?
Practice SBOM pipeline vocabulary: generating SBOMs at build time, SBOM-based vulnerability scanning, supply chain compliance, and CycloneDX vs SPDX format language.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
How many questions are in "SBOM in CI/CD Pipeline Vocabulary"?
This exercise has 22 questions. Each one gives instant feedback with an explanation, so you can see exactly why an answer is right or wrong.
Do I need to create an account to save my progress?
No account is required. The progress bar and score are tracked in your browser for the current session -- the exercise is designed to be a quick, repeatable drill rather than something you resume later.
What happens if I get an answer wrong?
You'll see the correct answer highlighted immediately, along with a short explanation of why it's correct. Wrong answers aren't penalized beyond your score, and you can keep going through every question.
How is this exercise different from reading an article?
Articles explain vocabulary and concepts through prose, while exercises like this one are interactive drills -- multiple-choice questions -- that test and reinforce your recall of specific terms and phrasing.
Can I retry this exercise?
Yes -- use the "Try again" button on the results screen to reset your score and go through all the questions again from the start.
Where can I find more Devsecops Pipeline Language exercises?
Browse the full Devsecops Pipeline Language hub for related drills, or check the site-wide exercises index for other IT English topics.
Is this exercise suitable for beginners?
This exercise assumes basic familiarity with IT terminology. If a term feels unfamiliar, check the site Glossary for a plain-English definition before attempting the questions.
How often is new content like this published?
New exercises are added regularly across all categories, alongside new vocabulary sets and articles. Check back on the exercises hub to see what's new.