Evaluate and Integrate Components CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which element is typically included in a trust contract between integrated systems?

   • AThe physical location of the servers hosting each system
   • BThe authentication and authorization requirements for accessing each system's resources
   • CThe exact encryption algorithms used for all data in transit
   • DThe internal code structure and design patterns used by each system
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company's application uses several open-source components. The security team wants to identify known vulnerabilities and license risks in these components. Which tool or practice is most appropriate?

   • ARun a software composition analysis (SCA) tool that scans the application's dependency manifest.
   • BPerform a manual code review of each open-source component.
   • CUse a network vulnerability scanner on the application's servers.
   • DCheck the application's firewall logs for suspicious activity.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A development team is integrating a third-party component that is no longer maintained by its original developer. The component has a known vulnerability. What is the most appropriate action?

   • AContinue using the component and rely on compensating controls.
   • BDisable the vulnerable feature in the component.
   • CReplace the component with a maintained alternative or fork that addresses the vulnerability.
   • DContact the original developer for a patch.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is a key security consideration when integrating third-party code with a restrictive open-source license?

   • AThe code will automatically be more secure because it is open source
   • BThe code must be rewritten to avoid license issues
   • CEnsuring compliance with the license terms to avoid legal and security risks
   • DThe code cannot be used in commercial products
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In a systems-of-systems context, what is the primary purpose of a trust contract between two integrated systems?

   • ATo define the security expectations and responsibilities each system has toward the other
   • BTo provide a legal agreement that absolves the integrating organization of liability for security breaches
   • CTo replace the need for authentication and authorization mechanisms between the systems
   • DTo document the network topology and data flow between the systems for auditing purposes
   Reveal Solution Discussion Select an answer first