ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

In a P2P environment, participating nodes are not centrally vetted, so update packages can be modified or forged in transit. The most reliable way to guarantee both integrity and authenticity is to have the software vendor sign each release with its private signing key and require every peer to verify that detached or embedded digital signature before accepting and installing the code. A per-session shared secret does not protect against content tampering once a peer is compromised. Checksums supplied by another peer can be forged alongside the package itself, providing no independent trust anchor. Limiting the number of peer connections may reduce exposure but does nothing to verify the correctness of the code obtained. Therefore, mandatory verification of vendor-issued digital signatures on every update is the strongest and most direct mitigation.