During a component risk assessment, a team finds that a third-party library has a high-severity vulnerability, but it is only exploitable if the application runs on Windows, and the application is deployed only on Linux. What should the team do?

Replace the library immediately to eliminate the vulnerability.

Monitor the vulnerability and decide later.

Document the vulnerability as not exploitable in the current environment and accept the risk.

Add the library to the SBOM but do not document the vulnerability.

A company has a component with a known vulnerability that is not exploitable in their environment. However, the company is required by a customer contract to patch all known vulnerabilities within 30 days. What should the company do?

Document the vulnerability as not exploitable and do not patch.

Ignore the contract and focus on technical risk.

Patch the vulnerability to comply with the contract, even though it is not exploitable.

A company uses a component that is no longer maintained. The component has a critical vulnerability, and the company cannot replace it in the short term. What is the best course of action?

Implement compensating controls and plan for replacement.

Fork the component and maintain it internally.

Remove the component immediately, even if it breaks the application.

Continue using the component and hope for the best.

A company's security team needs to respond quickly to a newly disclosed vulnerability in a widely used open-source component. They currently have no centralized record of which products use this component. What should they implement first?

A notification system for new vulnerabilities.

A policy requiring all components to be approved before use.

A vulnerability scanner that runs on every build.

A software bill of materials (SBOM) for all products.

A team is evaluating two libraries. Library A is from a well-known organization, has a permissive license, and is actively maintained. Library B is from an individual developer, has a restrictive license, and has not been updated in two years. The team needs a library for a commercial product. What should they do?

Choose Library B and document the licensing risk.

Choose Library B because it is smaller and easier to review.

Choose Library A and add it to the SBOM.

Choose Library A because of its provenance and license.

Certified Secure Software Lifecycle Professional

Domain 8Objective 1

Implement Software Supply Chain Risk Management (e.g., International Organization for Standardization (ISO), National Institute of Standards and Technology (NIST)) CSSLP Practice Questions (Page 3)

Part of the Secure Software Supply Chain domain, which accounts for 10% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 1–2 from this objective — we provide 20 practice questions to prepare you well beyond it. (estimate)

20questions here

4free pages

4concepts

10%of the exam

Questions 11–15

11application · medium
During a component risk assessment, a team finds that a third-party library has a high-severity vulnerability, but it is only exploitable if the application runs on Windows, and the application is deployed only on Linux. What should the team do?
Select an answer first
12expert · hard
A company has a component with a known vulnerability that is not exploitable in their environment. However, the company is required by a customer contract to patch all known vulnerabilities within 30 days. What should the company do?
Select an answer first
13expert · hard
A company uses a component that is no longer maintained. The component has a critical vulnerability, and the company cannot replace it in the short term. What is the best course of action?
Select an answer first
14application · medium
A company's security team needs to respond quickly to a newly disclosed vulnerability in a widely used open-source component. They currently have no centralized record of which products use this component. What should they implement first?
Select an answer first
15expert · hard
A team is evaluating two libraries. Library A is from a well-known organization, has a permissive license, and is actively maintained. Library B is from an individual developer, has a restrictive license, and has not been updated in two years. The team needs a library for a commercial product. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.