A development team uses a CI/CD pipeline that automatically builds and deploys a web application to a staging environment. The security team wants to ensure that known vulnerable dependencies are not deployed. Which control should be added to the pipeline?

Run a dynamic application security testing (DAST) tool against the staging environment after deployment and alert on findings.

Run a static application security testing (SAST) tool during the build stage and fail the build if any critical issues are found.

Run a software composition analysis (SCA) tool during the build stage and fail the build if any critical vulnerabilities are found.

Manually review the dependency list before each release and approve it in a change management ticket.

Certified Secure Software Lifecycle Professional

Domain 7Objective 3

Release Software Securely CSSLP Practice Questions (Page 7)

Part of the Secure Software Deployment, Operations, Maintenance domain, which accounts for 11% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 1–1 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

11%of the exam

Questions 31–31

31application · medium
A development team uses a CI/CD pipeline that automatically builds and deploys a web application to a staging environment. The security team wants to ensure that known vulnerable dependencies are not deployed. Which control should be added to the pipeline?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.

Release Software Securely CSSLP Practice Questions (Page 7)

Questions 31–31

A development team uses a CI/CD pipeline that automatically builds and deploys a web application to a staging environment. The security team wants to ensure that known vulnerable dependencies are not deployed. Which control should be added to the pipeline?

Keep studying — Secure Software Deployment, Operations, Maintenance