Provyn Prep · Security Fundamentals competency
Secure design & supply chain in the Security Fundamentals assessment
Secure design & supply chain is one of the areas a Provyn Security Fundamentals credential scores separately, so a recruiter can see it on its own rather than averaged into one number. This guide explains what it covers, how it is tested and what to practice.
What it covers
Designing for security: access control, defense in depth, cookie and browser policies, and the risks in third-party dependencies.
Topics in the practice set for this area
- access control
- defense in depth
- cookies
- CSP
How it is tested
In the timed assessment, questions in this area use these formats: incident walkthrough, multiple choice, put the steps in order, short answer. Each attempt draws its own set of questions, and this area gets its own sub-score on the credential when the attempt includes enough questions from it. The assessment questions themselves are never published; the practice set below is written separately for study.
What to practice
- Review an endpoint for broken access control by asking who else could call it.
- Set cookie flags and a basic Content-Security-Policy for a small app and explain each one.
- List how you would notice and respond to a vulnerable dependency.
Try a practice question
From the free practice set (4 questions in this area). Answers and explanations are in the practice set.
- Least privilege means:
- Defense in depth is:
- SameSite=Lax on a session cookie helps mitigate:
Practice before the real thing
Both are free and use practice questions only, never questions from the real assessment.
More Security Fundamentals study guides
Last reviewed 2026-10-06.