Evaluate and Integrate Components CSSLP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary function of software composition analysis (SCA)?

   • ATo identify known vulnerabilities and license risks in open-source and third-party components
   • BTo analyze the performance of the software under various load conditions
   • CTo test the software's user interface for usability issues
   • DTo review the source code for coding standard violations
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A retail company integrates its e-commerce site with a third-party customer relationship management (CRM) system. The integration shares customer data. The security team is analyzing the attack surface. Which element is most important to consider?

   • AThe API endpoint that transfers customer data between the two systems.
   • BThe e-commerce site's marketing banners.
   • CThe CRM system's employee training program.
   • DThe CRM system's internal database schema.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A development team is integrating a third-party component that has a known vulnerability. The component is essential to the application's functionality and no alternative exists. What is the most appropriate action?

   • ARemove the component from the application immediately.
   • BReplace the component with a custom-built module.
   • CApply a vendor-provided patch or workaround to mitigate the vulnerability.
   • DIgnore the vulnerability because the component is widely used.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A healthcare organization integrates its patient portal with a third-party lab results system. The integration sends patient data over a REST API. The security team needs to validate that the integration does not expose sensitive data to unauthorized parties. Which testing method is most appropriate for this validation?

   • AStatic application security testing (SAST) on the lab results system's source code.
   • BInterface testing that sends malformed requests to the API and verifies error handling and data exposure.
   • CLoad testing to ensure the API can handle peak traffic.
   • DUnit testing of the patient portal's business logic.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A telecommunications company integrates its billing system with a third-party payment processor. The integration uses a file-based transfer over SFTP. The security team is analyzing the attack surface. Which element is most critical to analyze?

   • AThe payment processor's marketing website.
   • BThe company's employee email system.
   • CThe SFTP server's authentication and file validation controls.
   • DThe billing system's internal reporting module.
   Reveal Solution Discussion Select an answer first