A company has multiple products that share several third-party components. They want to ensure that when a vulnerability is disclosed, they can quickly identify all affected products. What should they implement?

A manual spreadsheet of components used by each product.

A vulnerability scanner that only scans the latest product build.

A centralized SBOM repository that maps components to products.

A policy requiring each product team to maintain its own SBOM.

A security team receives an alert about a critical vulnerability in a component that is listed in their SBOM. The component is used in a production application. What should the team do first?

Immediately patch the component in production.

Remove the component from the application.

Notify the development team and wait for their response.

Assess the exploitability of the vulnerability in the context of the application.

During component risk assessment, a team discovers that a third-party library has a known vulnerability but no patch is available. What is the most appropriate next step?

Document the risk and either mitigate it with compensating controls or formally accept it if the risk is within the organization's tolerance

Wait for the vendor to release a patch without documenting the risk

Immediately remove the library from the codebase without further analysis

Ignore the vulnerability because the library is widely used

A security team subscribes to vulnerability alerts for the third-party libraries used in their product. What is the primary purpose of this continuous monitoring activity?

To detect newly disclosed vulnerabilities and respond promptly with patches or mitigations

To ensure that all components are updated to the latest version automatically

To reduce the need for periodic security assessments

To track the number of downloads of each component

A security architect is establishing a policy for approving open-source components. Which practice best supports secure component identification and selection?

Allowing developers to use any component they find as long as it compiles without errors

Requiring that each component be vetted for known vulnerabilities, license compatibility, and a verifiable source before approval

Preferring components with the most frequent releases, regardless of security history

Selecting components based solely on the size of the user community

Certified Secure Software Lifecycle Professional

Domain 8Objective 1

Implement Software Supply Chain Risk Management (e.g., International Organization for Standardization (ISO), National Institute of Standards and Technology (NIST)) CSSLP Practice Questions (Page 2)

Part of the Secure Software Supply Chain domain, which accounts for 10% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 1–2 from this objective — we provide 20 practice questions to prepare you well beyond it. (estimate)

20questions here

4free pages

4concepts

10%of the exam

Questions 6–10

6application · medium
A company has multiple products that share several third-party components. They want to ensure that when a vulnerability is disclosed, they can quickly identify all affected products. What should they implement?
Select an answer first
7application · medium
A security team receives an alert about a critical vulnerability in a component that is listed in their SBOM. The component is used in a production application. What should the team do first?
Select an answer first
8foundation · easy
During component risk assessment, a team discovers that a third-party library has a known vulnerability but no patch is available. What is the most appropriate next step?
Select an answer first
9foundation · easy
A security team subscribes to vulnerability alerts for the third-party libraries used in their product. What is the primary purpose of this continuous monitoring activity?
Select an answer first
10foundation · easy
A security architect is establishing a policy for approving open-source components. Which practice best supports secure component identification and selection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.