ACP Security, Compliance & Vulnerability Management 3

Question 1

Which Anaconda enterprise product provides a private, on-premise package repository with built-in security scanning?

Accepted Answer

Anaconda Team Edition / Anaconda Business

Answer

Anaconda Business (formerly Team Edition) and related enterprise offerings provide private, self-hosted package repositories with integrated vulnerability scanning and access controls.

Question 2

What does the `--no-default-packages` flag accomplish when creating a new conda environment for security-sensitive work?

Accepted Answer

Creates the environment without the packages listed in `create_default_packages`, reducing the attack surface

Answer

`--no-default-packages` skips installation of packages configured in `create_default_packages`, ensuring only explicitly requested packages are present and reducing unnecessary exposure.

Question 3

In a compliance-focused deployment, why is it important to set `channel_alias` in the conda configuration?

Accepted Answer

To redirect all channel requests through an approved internal proxy or mirror

Answer

`channel_alias` redirects channel lookups to an internal server, ensuring all package traffic flows through a controlled, monitored endpoint rather than the public internet.

Question 4

Which practice best mitigates the risk of a typosquatting attack when installing conda packages?

Accepted Answer

Specifying the exact channel alongside the package name (e.g., `conda install -c trusted-mirror scipy`)

Answer

Specifying the trusted channel explicitly prevents conda from resolving to a similarly-named malicious package on a lower-priority or public channel.

Question 5

What is the purpose of the `.condarc` `allowlist_channels` (formerly `whitelist_channels`) key?

Accepted Answer

Restricts conda to only use the listed channels, blocking any others

Answer

`allowlist_channels` enforces that conda will only communicate with the explicitly listed channels, preventing use of unauthorized or potentially malicious package sources.

(ACP) Anaconda Certified Professional Practice Test

(ACP) Anaconda Certified Professional Practice Test

ACP Security, Compliance & Vulnerability Management 3