ACP Security, Compliance & Vulnerability Management 2 — Questions and Answers
Question 1: Which conda command verifies the integrity of downloaded packages using cryptographic checksums?
- conda verify (Correct answer)
- conda install --check-integrity
- conda package --verify
- conda clean --verify
Correct answer: conda verify
`conda verify` checks package archives and installed packages against their expected checksums and metadata to detect tampering or corruption.
Question 2: What is the role of package signing in Anaconda's security model?
- It compresses packages for faster downloads
- It cryptographically authenticates that packages come from a trusted publisher (Correct answer)
- It assigns a unique build number to each package version
- It encrypts package contents to prevent reverse engineering
Correct answer: It cryptographically authenticates that packages come from a trusted publisher
Package signing uses cryptographic signatures (e.g., GPG or sigstore) to allow clients to verify that a package was produced and published by a trusted entity without modification.
Question 3: In Anaconda's role-based access control (RBAC), which role typically has permission to publish packages to a private channel?
- Viewer
- Contributor or higher (e.g., Owner) (Correct answer)
- Anonymous user
- Read-only collaborator
Correct answer: Contributor or higher (e.g., Owner)
In Anaconda's RBAC model, Contributor or Owner roles have the necessary permissions to upload and publish packages to private organizational channels.
Question 4: Which Anaconda feature allows administrators to audit which users installed or updated packages in a shared enterprise environment?
- Anaconda Nucleus activity logs (Correct answer)
- conda history --users
- environment.yml diff tracking
- PM2 process logs
Correct answer: Anaconda Nucleus activity logs
Anaconda Nucleus and enterprise repository solutions maintain activity logs that record user actions such as package installs and updates for compliance auditing.
Question 5: What is the recommended practice to prevent supply chain attacks when using conda?
- Always use the `--force-reinstall` flag
- Pin package versions and restrict channels to trusted internal mirrors (Correct answer)
- Disable SSL verification to speed up downloads
- Use `conda update --all` before every project run
Correct answer: Pin package versions and restrict channels to trusted internal mirrors
Pinning exact package versions and sourcing only from vetted internal mirrors reduces the risk of a malicious package being silently introduced into the environment.
Question 6: Which file in a conda environment records the exact package versions and build strings for full reproducibility and security auditing?
- environment.yml
- conda-lock.yml (Correct answer)
- requirements.txt
- setup.cfg
Correct answer: conda-lock.yml
`conda-lock.yml` captures exact package versions, build strings, and hashes, making it the authoritative lockfile for both reproducibility and security auditing.
Question 7: When configuring a conda channel with `channel_priority: strict`, what is the security benefit?
- It prevents older package versions from being installed
- It ensures packages are only resolved from the highest-priority channel, avoiding accidental use of untrusted channels (Correct answer)
- It forces HTTPS on all channel URLs
- It disables third-party channel access entirely
Correct answer: It ensures packages are only resolved from the highest-priority channel, avoiding accidental use of untrusted channels
With `channel_priority: strict`, conda resolves packages exclusively from the first matching channel in the priority list, preventing lower-priority (potentially untrusted) channels from supplying packages.
ACP Security, Compliance & Vulnerability Management 2
Which conda command verifies the integrity of downloaded packages using cryptographic checksums?