8.2 - Identify and Apply Security Controls in Software Development Ecosystems CISSP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which practice is most effective in mitigating the risk of using third-party libraries?

   • ARegularly updating libraries and monitoring for known vulnerabilities
   • BUsing libraries only from unofficial sources
   • CAvoiding all third-party libraries
   • DUsing the latest version of the library without checking for vulnerabilities
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which type of vulnerability is most likely to be detected by a Static Application Security Testing (SAST) tool?

   • ADenial of service due to high traffic
   • BSQL injection
   • CAuthentication bypass due to weak session management
   • DMisconfigured server settings
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company is deploying a Python web application. The security team is concerned about the risk of remote code execution if an attacker can exploit a vulnerability in the application. Which runtime environment control would most directly reduce this risk?

   • AUse a newer version of the Python interpreter that includes performance improvements.
   • BCompile the Python code to a native binary to prevent decompilation.
   • CRun the application in a container with a read-only filesystem and no shell access.
   • DStore the application's source code in a private repository with strict access controls.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company's source code is stored in a central Git repository. The security team requires that every change to the codebase be attributable to a specific developer and that no one can push directly to the main branch. Which combination of controls should be implemented?

   • AConfigure the repository to require two-factor authentication and set the main branch to read-only for all users.
   • BRequire developers to sign their commits with personal GPG keys and enable a branch protection rule that only allows merges through pull requests.
   • CUse a shared deployment key for all developers and enable a branch protection rule that requires a code review before merging.
   • DEnable signed commits using the organization's certificate authority and grant all developers write access to the main branch.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is a primary limitation of SAST tools?

   • AThey cannot detect vulnerabilities that only manifest at runtime
   • BThey require a running application to function
   • CThey can only be used on compiled languages
   • DThey are too slow to be used in CI/CD pipelines
   Reveal Solution Discussion Select an answer first