ACP Security, Compliance & Vulnerability Management 1 — Questions and Answers
Question 1: Which command is used to scan a conda environment for known security vulnerabilities?
- conda audit (Correct answer)
- conda scan --security
- conda verify --cve
- conda check --vulnerabilities
Correct answer: conda audit
`conda audit` is the built-in Anaconda tool that scans packages in an environment against known CVE databases.
Question 2: What does CVE stand for in the context of Anaconda security scanning?
- Common Vulnerability Exposure
- Common Vulnerabilities and Exposures (Correct answer)
- Conda Version Error
- Certified Vulnerability Entry
Correct answer: Common Vulnerabilities and Exposures
CVE stands for Common Vulnerabilities and Exposures, the industry-standard identifier for publicly known security flaws.
Question 3: In Anaconda Enterprise, which feature restricts users to installing packages only from approved internal channels?
- Channel pinning
- Package allowlisting via channel configuration (Correct answer)
- conda lock enforcement
- Namespace isolation
Correct answer: Package allowlisting via channel configuration
Package allowlisting via channel configuration ensures only vetted, approved packages from internal mirrors can be installed, enforcing compliance.
Question 4: Which file format does `conda audit` primarily reference to identify vulnerable package versions?
- conda-lock.yml
- NIST NVD / OSV database feeds (Correct answer)
- requirements.txt
- environment.yml
Correct answer: NIST NVD / OSV database feeds
`conda audit` queries vulnerability databases such as the NIST National Vulnerability Database (NVD) and OSV to match installed packages against known CVEs.
Question 5: What is the purpose of setting the `ssl_verify` configuration option in conda?
- Encrypts the local package cache
- Verifies SSL certificates when connecting to package repositories (Correct answer)
- Validates package signatures after download
- Enables two-factor authentication for conda login
Correct answer: Verifies SSL certificates when connecting to package repositories
`ssl_verify` controls whether conda validates the SSL/TLS certificate of remote channels, preventing man-in-the-middle attacks during downloads.
Question 6: Which conda configuration setting allows an organization to mirror Anaconda's default channel on a private server for security compliance?
- default_channels (Correct answer)
- channel_mirror
- offline_mode
- proxy_servers
Correct answer: default_channels
The `default_channels` setting can be overridden to point to an internal mirror, so all package requests go through a controlled, audited repository.
Question 7: When running `conda audit` on an environment, what output indicates that a package has a critical severity vulnerability?
- A yellow WARNING label
- A CRITICAL severity tag with the associated CVE ID (Correct answer)
- An asterisk (*) next to the package name
- A broken-pipe error in the terminal
Correct answer: A CRITICAL severity tag with the associated CVE ID
`conda audit` outputs vulnerability entries with severity labels (LOW, MEDIUM, HIGH, CRITICAL) alongside the CVE identifier for traceability.
ACP Security, Compliance & Vulnerability Management 1
Which command is used to scan a conda environment for known security vulnerabilities?