Skip to content
AI Security

Interview question · Software, Data & Model Supply Chain

What does SLSA build provenance assert, and what does each level defend against?

Provenance is only worth anything at the moment someone refuses to deploy because it does not match. Say where that moment is.

mediumEssentialNewPreparation tags: Google, Microsoft, AmazonUpdated Nov 2026

Provenance is only worth anything at the moment someone refuses to deploy because it does not match. Say where that moment is.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

signing in unlocks more free answers per topic

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

A customer asks how they can verify that your container image was built from your reviewed source, and mentions SLSA.

  1. What is provenance?
  2. What do SLSA build levels 1 to 3 mean?
  3. What if a malicious step runs inside the build?
  4. What must the customer do for provenance to matter?
  5. How would you start if you have no provenance today?
  6. What would you tell the customer?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Sign in free to open it.

UP NEXT ON YOUR JOURNEY
Next in this trackA Python dependency in your training pipeline is found to be malicious. Walk through your response.Next in this trackWhat is the risk of loading models that require custom or remote code?Next in this trackHow would you check a public pre-trained model for a backdoor, and what can you not detect?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.