ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question
A DevSecOps team supports an online banking application that uses a third-party JSON parser. A vendor patch correcting a buffer overflow has just been merged and all unit tests pass in the CI pipeline. According to secure patch-management practice, which action should the team take NEXT before promoting the build to production?
Conduct a peer code review focused on coding standards, then merge the patch into the main branch without further testing.
Run the full regression test suite and automated dynamic security scans in a staging environment that mirrors production.
Deploy the patched build directly to production during a low-traffic maintenance window and monitor for errors.
Accept the vendor's assurance, sign the change record, and fast-track the patch to production to reduce exposure time.
Patch-management guidance (e.g., NIST SP 800-40 and OWASP SAMM) stresses that new patches must be validated for both security effectiveness and functional impact prior to release. Running a full regression test suite in a staging environment exercises existing application features with production-like data while automated DAST confirms that the vulnerability is closed and no new weaknesses were introduced. Merely reviewing code, relying on vendor notes, or testing in production fails to verify behavior comprehensively and can expose customers to unvetted changes.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is a regression test suite?
Open an interactive chat with Bash
What is dynamic application security testing (DAST)?
Open an interactive chat with Bash
Why is a staging environment important in secure patch management?
Open an interactive chat with Bash
What is a buffer overflow vulnerability?
Open an interactive chat with Bash
What are Dynamic Application Security Testing (DAST) tools?
Open an interactive chat with Bash
Why is a staging environment necessary for regression testing?
Open an interactive chat with Bash
ISC2 Certified Secure Software Lifecycle Professional (CSSLP)