ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

A development team has generated a comprehensive software bill of materials (SBOM) for its web application and now needs to ensure that any newly disclosed Common Vulnerabilities and Exposures (CVEs) affecting third-party components are detected and remediated as quickly as possible. Which approach BEST meets this continuous monitoring requirement?

Schedule quarterly static application security tests (SAST) focusing on the project's proprietary source code.
Enforce TLS for all connections to the internal artifact repository hosting third-party binaries.
Instruct developers to review each component vendor's website for advisories at the start of every sprint.
Integrate an automated software composition analysis tool that continuously cross-references the SBOM with vulnerability intelligence feeds (e.g., NVD) and alerts on affected component versions.

Report Issue

Answer Description

Integrating an automated software composition analysis (SCA) tool into the continuous integration/continuous delivery (CI/CD) pipeline directly addresses the need for ongoing monitoring of third-party components. An SCA solution ingests the application's SBOM, maps listed components to vulnerability intelligence feeds such as the NVD, and generates real-time alerts when a new CVE matches a component version in use. This enables the team to triage, patch, or replace the affected dependency before it is exploited. Periodic static code analysis focuses on proprietary source code rather than external libraries, manual website checks are error-prone and untimely, and enabling TLS on an artifact repository protects data in transit but does not identify new vulnerabilities. Therefore, automating SCA with vulnerability feed integration is the most effective control for continuous monitoring of component changes and vulnerabilities.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.