Which of the following is a security risk specifically associated with the licensing of commercial off-the-shelf (COTS) software?

The software's inability to integrate with existing identity management systems

The software requiring more memory than available on the target systems

The software being incompatible with the organization's operating system version

Using the software beyond the licensed number of users, which may violate the license agreement

When using a managed service provider, what is a key security consideration regarding data handling?

Ensuring the provider uses the same hardware as the organization

Ensuring the provider's office is in the same country as the organization

Ensuring the provider implements appropriate encryption and access controls for the organization's data

Ensuring the provider has a large number of employees

When assessing the security impact of using an open source component, which of the following is a primary security consideration?

The cost of the component compared to a commercial alternative

The number of downloads the component has received from public repositories

The activity and responsiveness of the open source community in addressing security issues

The programming language used to develop the component

In the shared responsibility model, which cloud service model places the most security responsibility on the customer?

All service models place the same security responsibility on the customer

Infrastructure as a Service (IaaS)

A development team wants to integrate an open source library into a critical internal application. The library is widely used and has an active community, but the team has not yet reviewed its license. The security team is concerned about potential vulnerabilities. Which of the following actions should the team take FIRST?

Require the library maintainers to sign a support contract

Check the library's vulnerability database and known issues before integration

Perform a security code review of the entire library source code

Conduct a license compliance review to ensure the library's license is compatible with the organization's policies

Certified Information Systems Security Professional

Domain 8Objective 4

8.4 - Assess Security Impact of Acquired Software CISSP Practice Questions (Page 1)

Part of the Software Development Security domain, which accounts for 10% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 1–2 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

5concepts

10%of the exam

Questions 1–5

1foundation · easy
Which of the following is a security risk specifically associated with the licensing of commercial off-the-shelf (COTS) software?
Select an answer first
2foundation · easy
When using a managed service provider, what is a key security consideration regarding data handling?
Select an answer first
3foundation · easy
When assessing the security impact of using an open source component, which of the following is a primary security consideration?
Select an answer first
4foundation · easy
In the shared responsibility model, which cloud service model places the most security responsibility on the customer?
Select an answer first
5application · medium
A development team wants to integrate an open source library into a critical internal application. The library is widely used and has an active community, but the team has not yet reviewed its license. The security team is concerned about potential vulnerabilities. Which of the following actions should the team take FIRST?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.