ACP Security, Compliance & Vulnerability Management 2

Question 1

Which conda command verifies the integrity of downloaded packages using cryptographic checksums?

Accepted Answer

conda verify

Answer

`conda verify` checks package archives and installed packages against their expected checksums and metadata to detect tampering or corruption.

Question 2

What is the role of package signing in Anaconda's security model?

Accepted Answer

It cryptographically authenticates that packages come from a trusted publisher

Answer

Package signing uses cryptographic signatures (e.g., GPG or sigstore) to allow clients to verify that a package was produced and published by a trusted entity without modification.

Question 3

In Anaconda's role-based access control (RBAC), which role typically has permission to publish packages to a private channel?

Accepted Answer

Contributor or higher (e.g., Owner)

Answer

In Anaconda's RBAC model, Contributor or Owner roles have the necessary permissions to upload and publish packages to private organizational channels.

Question 4

Which Anaconda feature allows administrators to audit which users installed or updated packages in a shared enterprise environment?

Accepted Answer

Anaconda Nucleus activity logs

Answer

Anaconda Nucleus and enterprise repository solutions maintain activity logs that record user actions such as package installs and updates for compliance auditing.

Question 5

What is the recommended practice to prevent supply chain attacks when using conda?

Accepted Answer

Pin package versions and restrict channels to trusted internal mirrors

Answer

Pinning exact package versions and sourcing only from vetted internal mirrors reduces the risk of a malicious package being silently introduced into the environment.

(ACP) Anaconda Certified Professional Practice Test

(ACP) Anaconda Certified Professional Practice Test

ACP Security, Compliance & Vulnerability Management 2