Practice supply chain attestation vocabulary: build attestations, in-toto framework, cosign image signing, signature verification before deployment, and SLSA level requirements.
0 / 10 completed
1 / 10
'The build attestation proves the artifact was built by the pipeline.' What is a build attestation?
A build attestation is a machine-readable, cryptographically signed claim about how an artifact was produced. It states: this artifact (identified by its hash) was built from this source commit, by this build system, at this time, using these steps. Attestations enable consumers to verify the artifact's origin without trusting the artifact alone.
2 / 10
What is the in-toto framework used for in software supply chain security?
In-toto (Latin: 'as a whole') is a framework for securing the software supply chain end-to-end. It defines a 'layout' specifying what steps must occur (clone, build, test, package), who is authorised to perform each step, and what artifacts each step consumes and produces. Link metadata (attestations for each step) is verified against the layout.
3 / 10
'Cosign signs the container image.' What does cosign do?
Cosign (part of the Sigstore project) is a tool for signing and verifying container images. The signing process generates a cryptographic signature using the builder's private key and stores it in the OCI registry alongside the image. Consumers can verify the signature using the corresponding public key before pulling or deploying the image.
4 / 10
'The signature is verified before deployment.' What does this check prevent?
Verifying the signature before deployment ensures the container image has not been tampered with between build and deploy, and that it was produced by an authorised pipeline or person. This prevents attackers who gain registry access from substituting malicious images, and ensures the deployed artifact matches what was built and tested.
5 / 10
'The SLSA level 3 requirement includes attestation.' What is SLSA and what does level 3 guarantee?
SLSA (pronounced 'salsa') is a framework from Google for incrementally improving supply chain security. Level 3 requires: the build runs on a hardened, dedicated CI/CD platform; non-forgeable build provenance is generated; and the platform prevents builders from injecting untrusted inputs. Attestations are a core SLSA requirement for levels 2 and above.
6 / 10
Sarah from Security is asking you to review the PR description for a new container image. She mentions 'supply chain attestation' and asks if you can explain what she means in the context of ensuring the build process was trustworthy.
Which of the following best describes supply chain attestation?
Supply chain attestation focuses on proving the integrity of the entire process by which software is created and delivered. It's not simply about vulnerability scanning; it's a broader verification that each step – build, sign, and deploy – adhered to security policies defined within frameworks like SLSA. Option A describes firewall functionality, while options C and D relate to specific tools or techniques used *within* an attestation process.
7 / 10
Mark in DevOps sends you this Slack message: 'Just ran some In-Toto reports. The results show a few missing signatures on our base images! This is concerning because it means we haven't properly attested the build process.' What does Mark's message primarily highlight regarding In-Toto?
Which of the following best describes his concern?
Mark's message centers around the *signatures* generated by In-Toto. These signatures are crucial for attestation – they demonstrate that each stage of the build was verified against defined standards. Without signatures, it's impossible to confidently assert that the build process was secure and compliant. In-Toto itself doesn't directly patch vulnerabilities; it provides evidence of a secure build.
8 / 10
You're reviewing a PR that includes deploying a new service using a container image. The CI system generated a Cosign signature for the image. What is the primary purpose of this Cosign signature?
Select the best answer.
Cosign generates a cryptographic signature for the container image. This signature isn't for encryption (option A) or automatic updates (option D). Instead, it serves as proof of origin and integrity – confirming that the image originated from a trusted source and hasn't been tampered with since signing. The identifier is a *result* of the signature process, not its primary function.
9 / 10
David in Operations asks you to explain the importance of verifying the 'source code provenance' within a supply chain attestation. What does he mean?
Which statement best describes source code provenance?
Provenance refers to the complete history and lineage of a piece of software. Verifying 'source code provenance' means confirming that the code you're using originated from a trusted source – specifically, it was developed according to established processes and hasn't been compromised. This is about tracking its journey through the supply chain.
10 / 10
The team is discussing SLSA levels for a new project. They're particularly focused on Level 3. What does SLSA level 3 primarily guarantee?
Select the best answer.
SLSA Level 3 focuses on verifiable build processes. It guarantees that the build process itself has been audited and attested to—meaning independent verification confirms adherence to security policies like signing artifacts and providing traceability. This includes generating signatures for each stage, ensuring a secure and trustworthy build.
What will I learn from the "Supply Chain Attestation Vocabulary" exercise?
Practice supply chain attestation vocabulary: build attestations, in-toto framework, cosign image signing, signature verification before deployment, and SLSA level requirements.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall required.
How many questions are in this exercise?
This set contains 10 multiple-choice questions, each with a detailed explanation shown after you answer.
Do I need to create an account to track my progress?
No account is required. Your progress bar and score reset each time you reload the page, but you can retry the exercise as many times as you like.
Who is this Supply Chain Security exercise for?
This exercise is built for IT professionals and non-native English speakers who need to read, write, and discuss supply chain security topics confidently at work.
What happens if I answer a question incorrectly?
You will see the correct answer highlighted along with a detailed explanation of why it is correct -- so every wrong answer becomes a learning moment, not just a lost point.
Can I retry this exercise?
Yes -- click "Try again" on the results screen at any time to reset your score and go through all the questions again.
How long does this exercise take to complete?
Most learners finish all 10 questions in under 10 minutes, since each question is answered by clicking a single option.
Where can I find more Supply Chain Security exercises?
See the full Supply Chain Security exercises hub for more vocabulary drills on this topic.
Is this exercise mobile-friendly?
Yes -- the exercise works on any device with a modern browser, including phones and tablets, with no app download required.