Practice question 34 of 498 · hard
A production package has a valid signature, but its signing system was compromised before the release. Which conclusion is correct?
Choose the single best answer.
Show the answer and explanation
✓ Correct answer
- Signature verification alone is insufficient; protect the signing and release process and evaluate the artifact
Signature verification alone is insufficient; protect the signing and release process and evaluate the artifact: A compromised trusted signing system can produce a valid signature on malicious content. A valid signature proves every dependency is vulnerability-free: Signatures do not establish complete code safety. The package must be safe because its file was not modified after signing: Post-signing integrity does not prove the original signed content was benign. All artifact verification should be abandoned permanently: Verification remains useful within a protected provenance and release process.
Read and review here, or open the app to practise and save your results on this device.
Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.