Search the practice set
275 questions, 991 terms and 600 topics in 30 areas.
21 results for “Supply-Chain Provenance”
Artifact Signing
Cryptographically signing build outputs so that deployment can verify what is being run was produced by the expected pipeline from the expected source.
Build Attestation
A signed statement about how an artifact was produced — by which builder from which source — that a deployment gate can verify rather than trust.
Container Image
A layered, content-addressed filesystem bundle plus metadata, from which containers are instantiated — immutable by construction and identified by digest.
Image Registry
The store from which container images are pulled, and an under-appreciated availability and security dependency of every deployment and every autoscale event.
Software Bill of Materials
A machine-readable inventory of every component and dependency in a piece of software, including transitive ones, used to answer exposure questions quickly.
Certificate Chain
The sequence from a server's certificate through one or more intermediate CAs to a root the client already trusts.
DNS Resolution Chain
The sequence of lookups from browser cache through OS cache, recursive resolver, root, TLD and authoritative server that turns a name into an address.
Gateway Timeout Chain
The sequence of timeouts from client through load balancer, gateway and service, which must decrease inward or produce confusing failures.
Secure Boot Chain
Each boot stage verifying the signature of the next before executing it, anchored in immutable hardware, so only authorised software runs.
Data Lineage
A record of where each dataset came from, what transformed it, and what depends on it — traced at table and ideally column level.
Feedback Loop
A circular causal chain in which an effect influences its own cause, producing behaviour that cannot be understood by examining components in isolation.
Sidecar
Deploying a helper process alongside the main application in the same unit, to supply cross-cutting behaviour without changing the application.
Uber's H3 Spatial Index
Uber indexes the world with hexagons rather than squares, because uniform neighbour distance makes supply, demand and pricing computations correct as well as fast.
X-Forwarded-For
The header chain recording original client addresses through a series of proxies — and a value that must never be trusted without knowing the topology.
A critical CVE is announced in a widely-used library. Walk me through the first four hours.
Hour 1 — determine exposure Query the SBOMs across the estate , including transitive dependencies. This is the moment that justifies having them: without, this
A brief database slowdown caused a two-hour full outage. Explain the likely amplification chain and the fixes at each stage.
The chain Slow database → queries that took 10 ms take 2 s. Thread pool exhaustion. Requests hold threads for 200× longer. A pool of 50 that handled the load ea
Product wants to add a recommendation feature using browsing history. Legal asks for a data protection impact assessment. What does architecture need to supply?
What the assessment actually needs from architecture Legal cannot assess a feature description. They need the data facts, which only the design supplies: A data
The 2019 Capital One breach chained a server-side request forgery to an over-permissive IAM role. Walk the chain, and say which single control would have contained it.
The chain, as publicly reported 1. A misconfigured web application firewall permitted server side request forgery — the application could be induced to make an
A partner reports your API fails from their servers with a certificate error. It works in every browser you try and from your laptop. Diagnose and prevent.
The diagnosis An incomplete certificate chain. The server presents its own certificate but not the intermediates. Browsers frequently recover — they cache inter