Which of the following best describes a risk at the “Application” stage?

End-users unknowingly run malicious code

Which of the following is NOT a good practice to prevent supply chain attacks?

Using the latest version from a CDN

What’s the best way to ensure a package downloaded from npm is safe?

Audit packages and check for suspicious update history

What is the main risk of using a CDN to pull the “latest” version of a JavaScript package?

It could fetch a malicious version

What is the role of the version control system in the supply chain?

Tracks changes and supports collaboration

studbud

Supply Chain Attacks Game

10 termsStudBud Administration27 plays

Imported from external platform

Flashcards10 cardsFPractice quizPHost liveL

Questions 10

Answers

1
In the Lottie Player attack, what kind of script was injected into web apps?
Crypto wallet drainer
Password Keylogger
Ransomware download
Advertising redirector
2
At which stage in the software supply chain did the XcodeGhost attack occur?
CDN
NPM Registry
Developer Tools
Version Control
3
Which of the following best describes a risk at the “Application” stage?
The app uses a deprecated JavaScript method
A developer reuses passwords
The app uses a deprecated JavaScript method
End-users unknowingly run malicious code
4
Which of the following is NOT a good practice to prevent supply chain attacks?
Securing developer credentials
Pinning package versions
Monitoring NPM packages for changes
Using the latest version from a CDN
5
What’s the best way to ensure a package downloaded from npm is safe?
Only use packages published on weedays and not weekends
Trust packages with funny names
Audit packages and check for suspicious update history
Audit packages
6
What is the main risk of using a CDN to pull the “latest” version of a JavaScript package?
It could fetch a malicious version
Slow loading time
It won't automatically update
Users must install software manually
7
What is a key similarity between the XcodeGhost and Lottie Player attacks?
Both exploited the CDN
Both introduced malicious code
Both only affected Android applications
Both involved fake GitHub accounts
8
In the XcodeGhost attack, iOS developers intentionally installed malware into their apps.
True
False
9
A compromised npm access token allowed attackers to upload malicious versions of the Lottie Player.
False
True
10
What is the role of the version control system in the supply chain?
Delivers code through a CDN
Scans packages for malware
Runs user-facing applications
Tracks changes and supports collaboration

Supply Chain Attacks Game Flashcards | StudBud