Practice software provenance vocabulary: SBOM, artifact traceability, unbroken provenance chains, signed provenance requirements, and linking builds to source commits.
0 / 10 completed
1 / 10
'The SBOM tracks all components.' What is an SBOM?
An SBOM (Software Bill of Materials) is a machine-readable inventory of all components in a software product: open-source libraries, their versions, licences, and known vulnerabilities. SBOMs became a US government requirement for critical software after the 2021 executive order on cybersecurity. Common formats include SPDX and CycloneDX.
2 / 10
'The artifact was produced from commit X at time Y.' Why is this provenance data important?
Provenance data linking an artifact to its exact source commit, build time, and build environment allows: audit trails (who built what and when), reproducibility verification (can we rebuild the same artifact from the same source?), and incident investigation (if a vulnerability is found, which artifacts are affected?).
3 / 10
'We can trace the build to the exact source commit.' What security property does this enable?
Traceability from artifact to source commit enables you to verify that what's running in production is exactly what was reviewed and approved in source control. This is critical for detecting build-time attacks (where malicious code is injected during the build process) and for forensic investigation after a security incident.
4 / 10
'The provenance chain is unbroken.' What does an unbroken provenance chain mean?
An unbroken provenance chain means every transformation of the artifact — from source commit to compiled binary to container image to deployment — has a linked, signed attestation. If any step is missing an attestation, the chain is broken and consumers cannot fully verify the artifact's integrity. Gaps in the chain are potential injection points for attackers.
5 / 10
'We require signed provenance for all production artifacts.' What does signed provenance prevent?
Requiring signed provenance means every production artifact must have a cryptographically signed record of its origin and build process. This prevents attackers from creating or modifying artifacts outside the approved pipeline — any artifact without a valid signature from a trusted build system is rejected before deployment.
6 / 10
During a code review of the new image processing service, Alice points out that the generateThumbnail function uses a third-party library. Bob replies: 'I'm seeing 'provenance data' in the build logs. What does he likely mean?'
Provenance data isn't about UI design or thumbnail sizes; it's fundamentally about tracking where software comes from and how it's been modified. The term refers to the complete history of a component – its origin, transformations, and dependencies – crucial for security and auditing. Bob is correctly interpreting the message as relating to the lifecycle of that dependency.
7 / 10
Sarah sends this Slack message to her team after a vulnerability was discovered in a third-party component:
'Okay, so we need to immediately investigate the build process. We need to know *exactly* which commit introduced this issue and what changes were made afterward.' What is Sarah primarily concerned about regarding software provenance?
Sarah is focused on understanding the *chain* of events – specifically, tracing back through the build process. Knowing the precise commit that introduced the vulnerability allows for targeted rollback or further investigation into related changes. The Slack message highlights the importance of provenance in quickly addressing vulnerabilities and mitigating their effects.
8 / 10
You're reviewing a PR description for a new microservice that integrates with an external API. The description includes the following statement: 'The service utilizes the API_KEY variable, which is sourced from a secure vault and its provenance tracked throughout the deployment pipeline.' What does tracking the provenance of this variable primarily ensure?
Tracking provenance in this context centers on accountability and security. Knowing the origin and transformations of sensitive data like an API key allows for verification that it's being used correctly and that any unauthorized modifications can be detected. It's not about rate limits or dependency updates – those are separate concerns.
9 / 10
During a standup meeting, David explains: 'We're implementing signed provenance for all our deployment artifacts. This means each artifact will have a digital signature that verifies its authenticity and integrity.' What is the *primary* benefit of using signed provenance in this scenario?
Signed provenance provides a crucial layer of trust and verification. The digital signature confirms that the artifact hasn't been tampered with since it was signed – essentially guaranteeing its authenticity from the source. This is fundamental to preventing malicious code or configuration changes from entering production.
10 / 10
Mark is discussing the requirements for a new software development project with his team lead. He states: 'We need to ensure that all our artifacts have unbroken provenance.' What does an 'unbroken provenance chain' signify?
An 'unbroken provenance chain' means that there are no gaps or missing steps in the history of an artifact. Every modification and transformation is recorded and traceable – providing a complete audit trail. This allows for accurate tracking of any issues, security vulnerabilities, or compliance requirements throughout the software lifecycle.
What will I learn from the "Software Provenance Vocabulary" exercise?
Practice software provenance vocabulary: SBOM, artifact traceability, unbroken provenance chains, signed provenance requirements, and linking builds to source commits.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall required.
How many questions are in this exercise?
This set contains 10 multiple-choice questions, each with a detailed explanation shown after you answer.
Do I need to create an account to track my progress?
No account is required. Your progress bar and score reset each time you reload the page, but you can retry the exercise as many times as you like.
Who is this Supply Chain Security exercise for?
This exercise is built for IT professionals and non-native English speakers who need to read, write, and discuss supply chain security topics confidently at work.
What happens if I answer a question incorrectly?
You will see the correct answer highlighted along with a detailed explanation of why it is correct -- so every wrong answer becomes a learning moment, not just a lost point.
Can I retry this exercise?
Yes -- click "Try again" on the results screen at any time to reset your score and go through all the questions again.
How long does this exercise take to complete?
Most learners finish all 10 questions in under 10 minutes, since each question is answered by clicking a single option.
Where can I find more Supply Chain Security exercises?
See the full Supply Chain Security exercises hub for more vocabulary drills on this topic.
Is this exercise mobile-friendly?
Yes -- the exercise works on any device with a modern browser, including phones and tablets, with no app download required.