CSSLP Practice Questions: Secure Software Deployment, Operations, Maintenance Domain

Correct Answer: B

Explanation: The first action should be to assess the impact of the vulnerability on the application to understand the potential risk and determine the appropriate response. Removing the library or updating it without assessment could cause disruptions or incompatibilities. Notifying the team is important but should follow the impact assessment.

Correct Answer: C

Explanation: Implementing a software bill of materials (SBOM) and monitoring for vulnerabilities is crucial for managing risks associated with open-source components. It provides visibility into the components used and helps track vulnerabilities as they are discovered. Regular updates (A) are important but should be informed by vulnerability monitoring. A full security audit (B) is comprehensive but may not be feasible continuously. Restricting open-source use (D) may limit innovation and is not a practical approach to risk management.

Correct Answer: A

Explanation: Incorporating security testing tools into the CI/CD pipeline ensures that security checks are automated and occur continuously throughout the software lifecycle. This practice aligns with DevSecOps principles and helps in early detection and remediation of security issues. Quarterly audits (Option B) and annual training (Option D) are less frequent and may not catch issues promptly. A strict change management process (Option C) is important but does not directly integrate security into the development pipeline.

Correct Answer: B

Explanation: Implementing a compensating control and closely monitoring the application (B) is the best approach to manage the risk while maintaining business operations. Isolating the application (A) may not be feasible and could impact functionality. Decommissioning (C) is not an immediate solution and may not be viable if the application is critical. Ignoring the vulnerabilities (D) is not a responsible security practice.

Correct Answer: A

Explanation: Implementing automated security testing tools (Option A) within the CI/CD pipeline ensures continuous security checks and is aligned with the current implementation phase. Manual code reviews (Option B) are less scalable and may not catch all issues. Security training (Option C) and incident response planning (Option D) are important but do not directly contribute to secure deployment in the context of the implementation phase.