8.2 - Identify and Apply Security Controls in Software Development Ecosystems CISSP Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A development team uses a CI/CD pipeline that automatically builds and deploys a Java web application to production. A recent security review found that a known critical vulnerability exists in a third-party logging library included in the application. The team wants to prevent this class of issue from reaching production in the future. Which control should be added to the pipeline?

   • AAdd a SAST scan that runs after compilation to detect insecure code patterns in the application's source files.
   • BAdd an SCA tool to the build stage that checks all declared dependencies against vulnerability databases and fails the build on critical findings.
   • CAdd a runtime application self-protection (RASP) agent to the production servers to block exploitation of the vulnerable library.
   • DAdd a DAST scan against a staging environment after deployment to identify the vulnerable library by probing the running application.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A developer is using an IDE that supports plugins. The security team wants to ensure that developers receive immediate feedback on common vulnerabilities as they write code, without requiring them to run a separate command-line tool. Which action should the team take?

   • AConfigure the IDE to compile the code after every save and display compiler warnings.
   • BSet up a scheduled DAST scan that runs against the developer's local machine every night.
   • CRequire developers to run a code formatter before committing to ensure consistent style.
   • DInstall a SAST plugin in the IDE that analyzes the code in the background and displays warnings in the editor.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A software development team is required to produce an immutable record of exactly which source code version was used to build a specific release, along with the build environment and tool versions. Which configuration management practice should be implemented?

   • ATag the source code in the repository with the release version and store the build logs and tool versions alongside the tag.
   • BStore the compiled binary in a shared network folder with the release date in the filename.
   • CUse a build server that always uses the latest version of all tools and libraries.
   • DRequire developers to include the release version in every commit message.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security team is evaluating testing tools for a web application that is already deployed in a staging environment. They want to identify vulnerabilities that only appear when the application is running, such as authentication bypasses and insecure server configuration. Which testing approach should they use?

   • ARun a DAST tool that sends malicious requests to the staging application and analyzes the responses.
   • BRun a code coverage tool to measure which parts of the application are exercised by the test suite.
   • CRun a SAST tool against the application's source code to identify potential runtime flaws.
   • DRun an SCA tool to check the versions of all third-party libraries used by the application.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is the primary purpose of Software Composition Analysis (SCA) tools?

   • ATo monitor the application's performance in production
   • BTo analyze the application's source code for custom vulnerabilities
   • CTo identify known vulnerabilities in open-source and third-party components
   • DTo test the application's runtime behavior
   Reveal Solution Discussion Select an answer first