ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question
During an automated deployment, a DevSecOps engineer retrieves a JAR file from the company's artifact repository and must prove it is identical to the file produced by yesterday's signed build before promoting it to production. Which approach provides the strongest assurance of both integrity and authenticity in this situation?
Rely on the repository's HTTPS connection so the download cannot be modified in transit.
Recalculate the JAR's SHA-256 hash on the deployment host and compare it to the hash stored in a CI-generated manifest whose signature is verified first.
Compress the JAR with a lossless algorithm before transfer to reduce the chance of corruption during transport.
Run a static application security test (SAST) on the JAR before release to ensure no malicious code is present.
Generating a SHA-256 digest as part of the build, storing that value inside a signed manifest, and then recomputing the digest on the deployment server establishes two safeguards. Recomputing and comparing the hashes confirms bit-level integrity-any tampering alters the checksum. Because the original hash is contained in a file signed by the trusted CI system, verifying the signature first demonstrates the manifest itself is authentic and unmodified. Static analysis, compression, or relying only on TLS in transit do not validate that the artifact on disk is the exact one produced by the authorized build process, nor do they tie the artifact to an authenticated source.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
Why is SHA-256 used to verify integrity and authenticity?
Open an interactive chat with Bash
What is a CI-generated signed manifest?
Open an interactive chat with Bash
Why don’t HTTPS or compression methods ensure integrity or authenticity?
Open an interactive chat with Bash
What is SHA-256, and why is it important in verifying file integrity?
Open an interactive chat with Bash
What is a 'signed manifest,' and how does it ensure authenticity?
Open an interactive chat with Bash
Why is relying on HTTPS insufficient for validating file integrity and authenticity?
Open an interactive chat with Bash
ISC2 Certified Secure Software Lifecycle Professional (CSSLP)