An organization is adopting an open-source component for a cloud application. Which practice is the primary purpose of an open-source governance policy?

To ensure all open-source licenses are approved and their obligations are met

To eliminate the need for a software bill of materials

To guarantee that open-source code is free of all vulnerabilities

To automatically convert open-source licenses to proprietary licenses

A company is evaluating a third-party vendor that provides a software component used in its customer-facing application. Which factor is most important to assess in the vendor's supply chain risk?

The vendor's security incident response process and history of vulnerabilities in its products.

The vendor's marketing materials and brand recognition in the industry.

The vendor's office location and time zone relative to the company.

The vendor's customer support hours and availability of a phone line.

Which activity is a core part of managing the lifecycle of third-party software to maintain security?

Delegating all patching responsibilities to the vendor with no internal tracking

Tracking the software from acquisition through deployment, patching, and eventual decommissioning

Performing a one-time security review at purchase and then relying on the vendor's updates

Decommissioning software as soon as a new version is released, without further review

What is a key responsibility of an organization's open-source review board or committee?

Publishing open-source projects on behalf of all developers

Writing all code for the organization's cloud applications

Approving open-source components based on license and security criteria

Guaranteeing that no legal claims arise from open-source usage

A company plans to use an open-source library in a commercial product. Which action is most important to avoid legal and security risks?

Conduct a vulnerability scan on the library's source code.

Review the library's license terms to ensure they are compatible with the company's intended distribution model.

Register the library with the company's software asset management system.

Download the library from the official repository and verify its checksum.

Certified Cloud Security Professional

Domain 4Objective 5

Use Verified Secure Software CCSP Practice Questions (Page 2)

Part of the Cloud Application Security domain, which accounts for 16% of the CCSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 2–3 from this objective — we provide 12 practice questions to prepare you well beyond it. (estimate)

12questions here

3free pages

10concepts

16%of the exam

Questions 6–10

6foundation · easy
An organization is adopting an open-source component for a cloud application. Which practice is the primary purpose of an open-source governance policy?
Select an answer first
7foundation · medium
A company is evaluating a third-party vendor that provides a software component used in its customer-facing application. Which factor is most important to assess in the vendor's supply chain risk?
Select an answer first
8foundation · medium
Which activity is a core part of managing the lifecycle of third-party software to maintain security?
Select an answer first
9foundation · easy
What is a key responsibility of an organization's open-source review board or committee?
Select an answer first
10foundation · medium
A company plans to use an open-source library in a commercial product. Which action is most important to avoid legal and security risks?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CCSP” is a trademark of its owner, used for identification only.