Skip to main content

Validation Quiz - Training for Third Parties

This questionnaire is intended to validate whether third parties (suppliers, contractors or external teams) have understood the minimum mandatory content before receiving technical permissions.

📌 A minimum score of 80% and a formal record of the results are recommended.

🧪 Validation questions (base example)​

  1. When may a third party receive access to repositories or pipelines?

    • a) As soon as the contract is signed
    • b) After validation of the training and a formal record
    • c) When the PO so decides
    • d) If it is read-only access

    ✅ Correct answer: b)

  1. What should be done on finding a secret (e.g. token, password) in a .env file committed to the repository?

    • a) Ignore it, since it is in an ordinary file
    • b) Delete it locally only
    • c) Notify the team and follow the secret rotation process
    • d) Note in the README that it is temporary

    ✅ Correct answer: c)

  1. Which of these behaviours is considered secure in a PR?

    • a) Adding libraries without prior analysis
    • b) Leaving security comments without context
    • c) Using a PR template with a complete checklist
    • d) Merging even with failures in the validators

    ✅ Correct answer: c)

  1. Who should be contacted in case of doubts about permissions or secure practices?

    • a) Another third party on the same project
    • b) GitHub directly
    • c) The SPOC or internal channel indicated by the organisation
    • d) Nobody, so as not to delay the work

    ✅ Correct answer: c)

📋 Record of result (template)​

  • Name: __________________________
  • Company / Entity: __________________________
  • Email: __________________________
  • Date: __________________________
  • Result (%): _________
  • Internal validator (name): __________________________
  • Access granted: ✅ / ❌

🧭 Notes on use​

  • The quiz may be applied on paper, as a digital form, or embedded in the LMS
  • It is recommended to keep the record per project or contract, with the date and the internal owner
  • The training may be repeated in the event of failure or after contract renewal

💡 This quiz is an integral part of the formal third-party onboarding process. It may be adjusted by role or level of access, always keeping the basic validation principles.