Practise supply chain security vocabulary: pinning versions, integrity hashes, dependency audits, reading npm audit output, and SBOM language in professional English.
0 / 16 completed
1 / 16
A developer says: 'We should pin the version of that library.' What does this mean in practice?
Pinning means using an exact version string like '4.17.21' rather than a range like '^4.17.21'. This prevents the package manager from automatically installing a newer (potentially compromised) version. Pinning is combined with a lockfile for full reproducibility.
2 / 16
After running 'npm audit', the output reads: 'found 5 vulnerabilities (2 moderate, 2 high, 1 critical)'. What should the team prioritise first?
Critical vulnerabilities represent the highest severity level and should be addressed first. 'npm audit fix' can auto-resolve some; others require manual version upgrades. The severity levels in npm audit are: low → moderate → high → critical.
3 / 16
What is an 'integrity hash' in a lockfile (package-lock.json)?
The integrity field (e.g. sha512-abc123...) in package-lock.json is a cryptographic fingerprint of the exact tarball npm downloaded. On the next install, npm re-downloads and re-checks the hash — if they don't match, installation is aborted, protecting against tampering.
4 / 16
A security engineer asks for an SBOM before approving the deployment. What document are they requesting?
A Software Bill of Materials (SBOM) is a structured inventory of all software components — direct and transitive. It enables vulnerability tracking, licence compliance checking, and is increasingly required by governments and enterprises as part of supply chain security policy.
5 / 16
A vulnerability report states: 'CVE-2023-44487 affects an indirect dependency of your project.' This is an example of:
A transitive (indirect) vulnerability means your code doesn't import the vulnerable package directly, but one of your direct dependencies does. It is still your responsibility to mitigate — update the direct dependency to a version that uses a patched transitive dependency, or force-override the version if the package manager supports it.
6 / 16
Sarah (Senior Developer): 'I'm adding a checksum to the deployment script. It's crucial for verifying the integrity of the compiled binaries.' What is Sarah referring to when she mentions a 'checksum'?
Sarah is correctly using the term 'checksum' in the context of verifying data integrity. A checksum (often a hash) provides a unique fingerprint of the data; any change to the original data will result in a different checksum. This contrasts with encryption which transforms data for confidentiality, not necessarily verification.
7 / 16
Mark (DevOps Engineer) sends a Slack message: 'The latest build failed. The npm audit report shows several high-severity vulnerabilities in our dependencies – specifically related to outdated versions of Axios and React Router. I'm prioritizing remediation based on CVSS scores.' What does Mark mean by 'prioritizing remediation based on CVSS scores'?
Mark's action reflects best practices for vulnerability management. The CVSS (Common Vulnerability Scoring System) provides a standardized way to evaluate the severity of security vulnerabilities, offering a numerical score based on factors like exploitability and impact. Prioritizing by CVSS allows teams to focus resources on the most critical risks.
8 / 16
Emily (Security Analyst) asks during a standup meeting: 'Can we get an SBOM before deploying this new microservice?'. What information is Emily requesting when she asks for an SBOM?
Emily's request for an SBOM is crucial for assessing supply chain risk. An SBOM provides visibility into the microservice's dependencies, allowing security teams to identify potential vulnerabilities in those components and understand how they might impact the overall system. This proactive approach strengthens security posture.
9 / 16
Ben (Developer) reports a vulnerability: 'The root cause is an indirect dependency on the 'jerry-npm' package. The vulnerability affects a library that 'jerry-npm' itself uses.' What type of vulnerability is Ben describing?
Ben correctly identifies an indirect dependency vulnerability. This occurs when a security issue exists within a component that is itself a dependency of your project's dependencies. These vulnerabilities can be more difficult to detect and mitigate because they aren't immediately obvious.
10 / 16
David, a junior developer, says: 'Let's implement a digital signature on our API responses. It will ensure that the data hasn't been tampered with during transit.' What is David primarily referring to when suggesting a digital signature for API responses?
David is discussing digital signatures. This involves using cryptography – specifically hash functions and asymmetric keys – to create a unique fingerprint of the data. This allows for verification that the data hasn't been altered during transmission; encryption simply obscures the data, while rate limiting controls access and two-factor authentication focuses on user identity. A digital signature provides proof of origin and integrity.
11 / 16
During a Slack conversation, Liam (DevOps) sends: 'I've generated an SBOM for the new service. It shows we're using three third-party libraries with known vulnerabilities – notably, one relying on a component with a critical severity rating.' What does Liam's message primarily highlight concerning supply chain security?
Liam is referring to Software Bill of Materials (SBOM) – a comprehensive inventory of all software components within a system. The critical severity rating of a third-party dependency immediately indicates an area of concern and the need for proactive security measures like vulnerability scanning and patching. An SBOM provides visibility into the entire supply chain, allowing teams to quickly identify and address potential risks.
12 / 16
During a standup meeting, Alex (Developer) states: 'I'm adding a SHA-256 hash to the build process. It will ensure that the deployed artifacts haven't been modified.' What is Alex referring to when he mentions a 'SHA-256 hash'?
Alex is discussing SHA-256 hashes. This algorithm generates a unique 'fingerprint' of any data – in this case, the deployed software artifacts. If the content changes even slightly, the hash will be different, allowing for detection of tampering and ensuring the integrity of the build process. It's a fundamental tool for verifying that files haven't been corrupted or maliciously altered.
13 / 16
A code review comment reads: 'This function uses the `fetch` API. We should investigate potential vulnerabilities related to insecure headers and cross-site scripting.' What is the core security concern highlighted in this comment?
The comment focuses on security vulnerabilities associated with using the `fetch` API – a common network request method. Specifically, it highlights insecure headers (missing or misconfigured) and cross-site scripting (XSS), which are prevalent web application vulnerabilities that can lead to data breaches if not addressed properly. This emphasizes the importance of secure API design and implementation.
14 / 16
During a Slack discussion about securing a new API endpoint, Maria (Developer) says: 'Let's add a Content Security Policy (CSP) to the response headers. It will limit the sources from which the browser can load resources.' What is Maria primarily trying to achieve with a CSP?
Maria is referring to Content Security Policy (CSP), a browser security mechanism. A CSP defines a whitelist of sources from which the browser is allowed to load resources. This significantly reduces the risk of Cross-Site Scripting (XSS) attacks by preventing malicious scripts from being injected into the page. Option C accurately describes the core function of CSP.
15 / 16
As a DevOps Engineer, David is reviewing an SBOM generated for a new microservice. The report lists several vulnerabilities related to outdated versions of Node.js and Express. What does the SBOM primarily provide information about?
An SBOM (Software Bill of Materials) lists *all* the components – libraries, frameworks, operating systems – that make up a software application. It's crucial for understanding dependencies and identifying vulnerabilities associated with those components. Option C accurately describes the primary purpose of an SBOM.
16 / 16
In a Slack channel discussing security best practices, Lisa (Security Analyst) says: 'We need to implement a checksum on our deployment scripts. It's crucial for verifying the integrity of the compiled binaries.' What does Lisa mean by 'checksum'?
A checksum (like MD5 or SHA-256) is a mathematical value representing the data's content. If the data changes even slightly, the checksum will change as well, signaling that corruption has occurred. This allows for detecting errors introduced during deployment or transfer.
What will I practise in "Supply Chain Security Vocabulary"?
This module focuses on Package Management — real workplace phrasing you'll use on the job. It contains 16 scenario-based multiple-choice questions with instant feedback.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account or sign-up required.
How many questions does this exercise have?
This module includes 16 questions. Each one gives an immediate right/wrong result plus a full explanation of the correct phrasing.
What happens if I answer a question incorrectly?
You'll see the correct answer highlighted straight away, along with a plain-English explanation of why it's right and why the other options don't fit — mistakes are part of the learning here.
Can I retry the exercise if I want a better score?
Yes — use the 'Try again' button on the results screen to reset your score and go through the questions again. There's no limit on attempts.
Who is this Package Management exercise for?
It's aimed at IT professionals with working English who want to sound more natural and precise around package management — useful whether you're preparing for real conversations at work or just building confidence with the vocabulary.
Do I need an account to track my progress?
No account is needed. Your progress through the exercise is tracked locally in your browser for the current session, and you can replay the module at any time.
How is this different from reading a blog article?
This exercise is an interactive drill that tests and reinforces specific phrasing through multiple-choice questions with instant feedback, while blog articles explain concepts and vocabulary in prose. The two work well together.
Where can I find more Package Management exercises?
See the Package Management hub for more modules like this one, or browse the full Exercises page for other IT-English topics.
Can I complete this exercise on my phone?
Yes — every exercise on CoderSlingo is fully responsive and works on phones and tablets, so you can practise anywhere.