Question 550
After a prior release controls finding, a cloud service provider reports that the approved safeguard is implemented: “Use controlled build provenance, reviewed releases and authorized deployment identities.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Copy code by email directly to production
- Run this adjacent but different test as the sole proof: Submit a deliberately vulnerable test build and verify its disposition and recorded exception behavior
- Accept a signed change ticket saying: Use controlled build provenance, reviewed releases and authorized deployment identities
- Compare the deployed artifact digest with the approved signed build and deployment log
Explanation
Correct Answer
D:Digest and identity matching verify provenance end to end.
Incorrect Answers
A:Untracked artifacts can be altered. Compare the deployed artifact digest with the approved signed build and deployment log.
B:Negative build testing proves the gate is operative. It tests security gates, while this case requires evidence about release controls.
C:Compare the deployed artifact digest with the approved signed build and deployment log. Digest and identity matching verify provenance end to end.
Question 551
A new customer portal proposes storing raw password reset tokens in application logs. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use a permanent reset token per customer
- Introduce risk-based mandatory release gates with ownership and controlled exception paths
- Keep full tokens in logs so support can replay resets
- Design one-time short-lived reset tokens, protect token storage and prevent logging of usable secrets
Explanation
Correct Answer
D:Authentication recovery should not leak credentials into diagnostic systems.
Incorrect Answers
A:Persistent recovery secrets magnify theft exposure.
B:Alerts without an enforceable decision allow unacceptable releases. Design one-time short-lived reset tokens, protect token storage and prevent logging of usable secrets.
C:Logging makes tokens available to unintended readers.
Question 552
An incident review documented this agile/devsecops exposure: Two-week sprints deliver features but security testing happens only once at the annual audit. The response team proposed only “Disable continuous integration until the yearly assessment” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Late reviews may miss release-blocking issues.
- New interfaces alter attack surface.
- Stopping automation delays useful feedback.
- Obfuscation cannot establish authorization.
Explanation
Correct Answer
C:Stopping automation delays useful feedback. The relevant alternative is stopping automation delays useful feedback.
Incorrect Answers
A:Late reviews may miss release-blocking issues. The actual criticized measure is stopping automation delays useful feedback.
B:A newly exposed interface changes the threat model, but stopping continuous integration does not improve the sprint team’s security feedback or test cadence.
D:This describes the unrelated secure design decision rather than the named faulty measure Disable continuous integration until the yearly assessment.
Question 553
An incident review documented this threat model exposure: A product adds a new third-party payment callback after the threat model was approved. The response team proposed only “Treat the old diagram as permanently valid” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- New interfaces alter attack surface.
- Patching cannot resolve logical authorization flaws.
- Stopping automation delays useful feedback.
- Obfuscation cannot establish authorization.
Explanation
Correct Answer
A:New interfaces alter attack surface. The relevant alternative is new interfaces alter attack surface.
Incorrect Answers
B:Patching cannot resolve logical authorization flaws. The actual criticized measure is new interfaces alter attack surface.
C:Stopping continuous integration delays useful feedback; the newly added third-party payment callback instead requires an updated threat model and interface-specific controls.
D:This describes the unrelated secure design decision rather than the named faulty measure Treat the old diagram as permanently valid.
Question 554
After a prior security gates finding, a payment-services company reports that the approved safeguard is implemented: “Introduce risk-based mandatory release gates with ownership and controlled exception paths.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Submit a deliberately vulnerable test build and verify its disposition and recorded exception behavior
- Run this adjacent but different test as the sole proof: Trace representative abuse cases to implemented controls and test evidence
- Use the completion of this alternative as proof: Suppress critical scanner alerts on release day
- Accept a signed change ticket saying: Introduce risk-based mandatory release gates with ownership and controlled exception paths
Explanation
Correct Answer
A:Negative build testing proves the gate is operative.
Incorrect Answers
B:Requirement traceability demonstrates that design intent reached the application. It tests secure design, while this case requires evidence about security gates.
C:Hiding evidence weakens governance. Submit a deliberately vulnerable test build and verify its disposition and recorded exception behavior.
D:Submit a deliberately vulnerable test build and verify its disposition and recorded exception behavior. Negative build testing proves the gate is operative.
Question 555
An incident review documented this release controls exposure: A production release can be deployed from any developer laptop without approval or artifact signing. The response team proposed only “Copy code by email directly to production” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Retroactive authorization is costly and risky.
- Late reviews may miss release-blocking issues.
- Broad access makes unauthorized releases easier.
- Untracked artifacts can be altered.
Explanation
Correct Answer
D:Untracked artifacts can be altered. The relevant alternative is untracked artifacts can be altered.
Incorrect Answers
A:Retroactive authorization is costly and risky. That does not establish untracked artifacts can be altered.
B:Late reviews may miss release-blocking issues. The actual criticized measure is untracked artifacts can be altered.
C:Broad access makes unauthorized releases easier. The actual criticized measure is untracked artifacts can be altered.
Question 556
A build pipeline holds permanent production credentials available to every pull request. Which response best addresses the central security requirement with a defensible, risk-based design?
- Run unreviewed forks with production secrets
- Run authorized dynamic application security testing against the running service with bounded scope
- Use ephemeral workload identity, protected branches and narrowly scoped deployment permissions
- Store root API keys in repository variables
Explanation
Correct Answer
C:Untrusted build steps must not inherit standing production secrets.
Incorrect Answers
A:Forked code could exfiltrate credentials.
B:DAST tests observable runtime HTTP behavior rather than only source text. Use ephemeral workload identity, protected branches and narrowly scoped deployment permissions.
D:Encrypted-at-rest storage does not eliminate overly privileged use.
Question 557
A billing service uses a third-party component with a known exploitable flaw but no owner tracks its versions. Which response best addresses the central security requirement with a defensible, risk-based design?
- Maintain a version inventory or SBOM and a risk-based vulnerable-dependency remediation workflow
- Upgrade only the application code and never dependencies
- Run static application security analysis on source or build artifacts and review findings
- Assume compile success proves all dependencies safe
Explanation
Correct Answer
A:Dependency transparency enables timely response to third-party defects.
Incorrect Answers
B:Component flaws remain reachable.
C:SAST examines code paths without requiring a live running target. Maintain a version inventory or SBOM and a risk-based vulnerable-dependency remediation workflow.
D:A working build may contain vulnerable libraries.
Question 558
A web team wants to find unsafe data flows before executing the application. Which response best addresses the central security requirement with a defensible, risk-based design?
- Revoke or rotate the compromised token and scan code history and build artifacts
- Rely only on firewall packet counts
- Use only an external uptime monitor
- Run static application security analysis on source or build artifacts and review findings
Explanation
Correct Answer
D:SAST examines code paths without requiring a live running target.
Incorrect Answers
A:Deleting a commit file does not invalidate an already copied credential. Run static application security analysis on source or build artifacts and review findings.
B:Packet counts cannot identify source-code injection paths.
C:Availability probes do not find insecure data flow.
Question 559
An application is deployed to staging and the security team wants to assess its exposed authentication and input paths as a black box. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use ephemeral workload identity, protected branches and narrowly scoped deployment permissions
- Run invasive tests against production without permission
- Use static source scanning alone as the sole runtime test
- Run authorized dynamic application security testing against the running service with bounded scope
Explanation
Correct Answer
D:DAST tests observable runtime HTTP behavior rather than only source text.
Incorrect Answers
A:Untrusted build steps must not inherit standing production secrets. Run authorized dynamic application security testing against the running service with bounded scope.
B:Uncontrolled scanning may disrupt users.
C:Static findings do not guarantee deployed behavior.
Question 560
A product contains hundreds of open-source packages and licensing obligations. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use software composition analysis for component inventory, known vulnerabilities and license-policy checks
- Treat unit-test pass as complete license compliance
- Use interactive application security testing with runtime instrumentation in the test environment
- Remove package metadata to reduce alerts
Explanation
Correct Answer
A:SCA examines dependencies rather than first-party application source logic.
Incorrect Answers
B:Functional tests do not assess licensing.
C:IAST combines live execution context with application instrumentation. Use software composition analysis for component inventory, known vulnerabilities and license-policy checks.
D:Hidden dependency information worsens governance.
Certified Information Systems Security Professional (CISSP) Practice Tests