ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question
Your team hosts a private Git server for a regulated fintech application. A recent assessment notes that anyone with write access could alter commit history or push code under another developer's identity, undermining audit trails. Which control would BEST add tamper-evident, verifiable authorship to every change recorded in the repository?
Mandate that all commits and tags be signed with each developer's private PGP or SSH key and verified on the server.
Schedule nightly offline backups of the bare repository to immutable storage.
Enable Git Large File Storage (LFS) to separate binaries from source code.
Implement a strict Git flow requiring pull requests and preventing direct pushes to the main branch.
Cryptographically signing each commit and tag binds the author's private key to the change set, producing a signature that the Git server and reviewers can automatically verify. This makes any later alteration or forged identity immediately evident, providing strong integrity and non-repudiation for version history. Branch protection rules, backups, or large-file support improve governance or availability, but they do not in themselves guarantee that the content and author of every commit are authentic and unchanged.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What does signing commits with PGP or SSH keys mean?
Open an interactive chat with Bash
How does cryptographic signing improve audit trails?
Open an interactive chat with Bash
Why is verifying signatures on the server important?
Open an interactive chat with Bash
What does PGP stand for and how does it contribute to secure commits?
Open an interactive chat with Bash
How does cryptographic signing ensure tamper-evidence in Git repositories?
Open an interactive chat with Bash
What are branch protection rules and why are they insufficient for verifying authorship?
Open an interactive chat with Bash
ISC2 Certified Secure Software Lifecycle Professional (CSSLP)