8.2 - Identify and Apply Security Controls in Software Development Ecosystems CISSP Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is a security control that should be applied to software configuration management processes?

   • ARequiring peer review and approval for changes
   • BUsing the same configuration for all environments
   • CDisabling version control to simplify the process
   • DAllowing all developers to directly modify the production code
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary purpose of a build automation tool in a secure software development environment?

   • ATo automatically fix security vulnerabilities in the code
   • BTo manage user access to the code repository
   • CTo replace the need for manual code reviews
   • DTo compile code and create executable artifacts consistently
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A developer wants to use a popular open-source library in a new project. The security team has a policy that all third-party code must be vetted before it is used. Which action should the developer take to comply with this policy?

   • ACheck the library's version against a vulnerability database and review its source code for obvious security issues.
   • BDownload the library and add it to the project's dependencies without further review.
   • CUse the latest version of the library and assume it is secure because it is up to date.
   • DRely on the library's popularity and the number of downloads as proof that it is secure.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company's application uses a third-party library that has a known critical vulnerability. The library is used in a non-network-facing component of the application. The security team must decide how to handle this issue. The team wants to minimize the risk while also avoiding an unnecessary emergency release. Which action is most appropriate?

   • ARemove the library from the application entirely and rewrite the functionality using internal code.
   • BDocument the risk, verify that the component is not reachable by untrusted users, and schedule the upgrade in the next regular release cycle.
   • CImmediately upgrade the library to the latest version, even if it introduces breaking changes.
   • DIgnore the vulnerability because the component is not network-facing.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which programming language characteristic is most directly associated with memory safety vulnerabilities such as buffer overflows?

   • AStrong typing
   • BInterpreted execution
   • CAutomatic garbage collection
   • DManual memory management
   Reveal Solution Discussion Select an answer first