Question 560
A product contains hundreds of open-source packages and licensing obligations. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use software composition analysis for component inventory, known vulnerabilities and license-policy checks
- Treat unit-test pass as complete license compliance
- Use interactive application security testing with runtime instrumentation in the test environment
- Remove package metadata to reduce alerts
Explanation
Correct Answer
A:SCA examines dependencies rather than first-party application source logic.
Incorrect Answers
B:Functional tests do not assess licensing.
C:IAST combines live execution context with application instrumentation. Use software composition analysis for component inventory, known vulnerabilities and license-policy checks.
D:Hidden dependency information worsens governance.
Question 561
A Java web service needs instrumentation-assisted vulnerability observations during integration tests. Which response best addresses the central security requirement with a defensible, risk-based design?
- Run static application security analysis on source or build artifacts and review findings
- Run a standalone port scan and label it IAST
- Use interactive application security testing with runtime instrumentation in the test environment
- Claim static lint alone observes every runtime route
Explanation
Correct Answer
C:IAST combines live execution context with application instrumentation.
Incorrect Answers
A:SAST examines code paths without requiring a live running target. Use interactive application security testing with runtime instrumentation in the test environment.
B:Port scanning does not instrument application flows.
D:Lint cannot establish executed paths.
Question 562
A developer accidentally committed an API token into a private repository and then deleted the file. Which response best addresses the central security requirement with a defensible, risk-based design?
- Assume git deletion makes the secret unusable
- Revoke or rotate the compromised token and scan code history and build artifacts
- Use interactive application security testing with runtime instrumentation in the test environment
- Suppress the alert because the repository is private
Explanation
Correct Answer
B:Deleting a commit file does not invalidate an already copied credential.
Incorrect Answers
A:Copies can survive in history and logs.
C:IAST combines live execution context with application instrumentation. Revoke or rotate the compromised token and scan code history and build artifacts.
D:Private repositories can still leak.
Question 563
An engineer can force-push protected branches and bypass peer review for sensitive application code. Which response best addresses the central security requirement with a defensible, risk-based design?
- Rely on a verbal agreement not to bypass reviews
- Use software composition analysis for component inventory, known vulnerabilities and license-policy checks
- Enforce protected branches, signed or attributable changes and separation of approval from deployment
- Store production credentials in the same repo for convenience
Explanation
Correct Answer
C:Repository governance protects integrity of source changes.
Incorrect Answers
A:Informal trust does not enforce policy.
B:SCA examines dependencies rather than first-party application source logic. Enforce protected branches, signed or attributable changes and separation of approval from deployment.
D:Source compromise would expose deployment secrets.
Question 564
A compromised build worker can replace a release package after tests but before deployment. Which response best addresses the central security requirement with a defensible, risk-based design?
- Enforce protected branches, signed or attributable changes and separation of approval from deployment
- Trust the package filename as proof of identity
- Allow deployments from arbitrary unsigned files
- Bind artifact signing and provenance to an isolated trusted build output and verify at deploy time
Explanation
Correct Answer
D:Post-test artifact substitution defeats security tests unless integrity is verified.
Incorrect Answers
A:Repository governance protects integrity of source changes. Bind artifact signing and provenance to an isolated trusted build output and verify at deploy time.
B:Names do not attest to bytes.
C:Unsigned artifacts cannot prove build origin.
Question 565
A development team downloads packages by mutable version tags from an untrusted mirror. Which response best addresses the central security requirement with a defensible, risk-based design?
- Trust a package merely because its name matches an approved library
- Run authorized dynamic application security testing against the running service with bounded scope
- Disable package verification to speed builds
- Pin approved dependency digests and verify authenticated provenance from trusted registries
Explanation
Correct Answer
D:Digest pinning reduces unexpected component substitution.
Incorrect Answers
A:A device name is easy to forge and is not proof of device identity.
B:DAST tests observable runtime HTTP behavior rather than only source text. Pin approved dependency digests and verify authenticated provenance from trusted registries.
C:Integrity checks protect against substitution.
Question 566
An automated code scanner reports SQL injection where the parameter is already bound safely. Which response best addresses the central security requirement with a defensible, risk-based design?
- Automatically rewrite all SQL using string concatenation
- Maintain a version inventory or SBOM and a risk-based vulnerable-dependency remediation workflow
- Validate data flow and exploitability before changing the implementation or recording an exception
- Delete the scanner rule permanently for the whole organization
Explanation
Correct Answer
C:SAST has false positives and needs source-context assessment.
Incorrect Answers
A:Concatenation can create actual injection.
B:Dependency transparency enables timely response to third-party defects. Validate data flow and exploitability before changing the implementation or recording an exception.
D:Broad suppression can hide real defects.
Question 567
An API security scan finds HTTP 500 responses but cannot establish an exploitable vulnerability. Which response best addresses the central security requirement with a defensible, risk-based design?
- Classify every error response as a confirmed critical breach
- Reproduce suspicious behavior under authorized test conditions and distinguish errors from real security impact
- Ignore all runtime findings because tests can be noisy
- Maintain a version inventory or SBOM and a risk-based vulnerable-dependency remediation workflow
Explanation
Correct Answer
B:Server errors alone do not prove exploitability.
Incorrect Answers
A:An error is not necessarily a security flaw.
C:Real vulnerabilities may be among the findings.
D:Dependency transparency enables timely response to third-party defects. Reproduce suspicious behavior under authorized test conditions and distinguish errors from real security impact.
Question 568
After a prior sca finding, a global logistics firm reports that the approved safeguard is implemented: “Use software composition analysis for component inventory, known vulnerabilities and license-policy checks.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Match sampled runtime packages to SCA output and verify recorded risk treatment
- Use the completion of this alternative as proof: Treat unit-test pass as complete license compliance
- Run this adjacent but different test as the sole proof: Run instrumented tests through a seeded unsafe route and verify actionable finding context
- Accept a signed change ticket saying: Use software composition analysis for component inventory, known vulnerabilities and license-policy checks
Explanation
Correct Answer
A:Reconciliation ensures the scanned components match shipped software.
Incorrect Answers
B:Functional tests do not assess licensing. Match sampled runtime packages to SCA output and verify recorded risk treatment.
C:Instrumented execution shows whether the vulnerable path was exercised. It tests iast, while this case requires evidence about sca.
D:Match sampled runtime packages to SCA output and verify recorded risk treatment. Reconciliation ensures the scanned components match shipped software.
Question 569
After a prior iast finding, a regional hospital network reports that the approved safeguard is implemented: “Use interactive application security testing with runtime instrumentation in the test environment.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Run a standalone port scan and label it IAST
- Run instrumented tests through a seeded unsafe route and verify actionable finding context
- Accept a signed change ticket saying: Use interactive application security testing with runtime instrumentation in the test environment
- Run this adjacent but different test as the sole proof: Seed a test unsafe data flow and confirm scanner detection plus triage
Explanation
Correct Answer
B:Instrumented execution shows whether the vulnerable path was exercised.
Incorrect Answers
A:Port scanning does not instrument application flows. Run instrumented tests through a seeded unsafe route and verify actionable finding context.
C:Run instrumented tests through a seeded unsafe route and verify actionable finding context. Instrumented execution shows whether the vulnerable path was exercised.
D:A known test defect checks SAST effectiveness. It tests sast, while this case requires evidence about iast.
Question 570
After a prior secret scanning finding, a payment-services company reports that the approved safeguard is implemented: “Revoke or rotate the compromised token and scan code history and build artifacts.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Attempt use of the revoked test token and verify rejection plus clean history review
- Run this adjacent but different test as the sole proof: Run instrumented tests through a seeded unsafe route and verify actionable finding context
- Accept a signed change ticket saying: Revoke or rotate the compromised token and scan code history and build artifacts
- Use the completion of this alternative as proof: Assume git deletion makes the secret unusable
Explanation
Correct Answer
A:Revocation validation proves the credential is no longer usable.
Incorrect Answers
B:Instrumented execution shows whether the vulnerable path was exercised. It tests iast, while this case requires evidence about secret scanning.
C:Attempt use of the revoked test token and verify rejection plus clean history review. Revocation validation proves the credential is no longer usable.
D:Copies can survive in history and logs. Attempt use of the revoked test token and verify rejection plus clean history review.
Certified Information Systems Security Professional (CISSP) Practice Tests