The Concept of OSS and Its Impacts on Security Testing CT-STE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company's product uses an open-source component that has a known critical vulnerability. The component is deeply integrated into the product, and replacing it would require significant rework. The company has a strict release schedule. What is the most appropriate risk management approach?

   • ADisable the affected functionality until the component is replaced.
   • BAccept the risk and proceed with the release, documenting the vulnerability.
   • CApply a temporary mitigation, such as a WAF rule, and plan a replacement in the next release.
   • DImmediately replace the component, even if it delays the release.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a supply chain attack in the context of OSS?

   • AAn attack that uses social engineering to trick users into downloading a fake OSS project.
   • BAn attack that exploits a vulnerability in the OSS license agreement.
   • CAn attack that targets the development and distribution process of OSS to inject malicious code.
   • DAn attack that overwhelms the OSS project's download servers with traffic.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is considering using an open-source library licensed under the MIT License in a proprietary commercial product. What is the primary security testing implication of this license?

   • AThe library is guaranteed to be secure because it is permissively licensed.
   • BThe library can be used freely, but the security team must still test it for vulnerabilities.
   • CThe company must release its proprietary source code to comply with the license.
   • DThe security team must avoid using the library because it is not secure.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security tester discovers that a product includes an open-source component under the GPL license, but the product is distributed as closed-source. The legal team is concerned about compliance. What is the most appropriate action for the security tester?

   • AReport the licensing issue to the project manager and recommend a legal review.
   • BIgnore the issue because it is not a security vulnerability.
   • CReplace the GPL component with a proprietary alternative immediately.
   • DRelease the product's source code to comply with the GPL.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A development team uses a build process that automatically downloads the latest version of an open-source dependency from a public repository. What is the most significant security risk of this practice?

   • AThe dependency may not be compatible with the application's architecture.
   • BThe dependency may introduce a supply chain attack if the repository is compromised.
   • CThe dependency may require additional testing effort due to frequent updates.
   • DThe dependency may have a license that restricts commercial use.
   Reveal Solution Discussion Select an answer first