ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

Using an untrusted or third-party library exposes the application to any publicly known or newly introduced vulnerabilities in that component or in the additional packages it pulls in transitively. The appropriate first step is to perform software composition analysis (SCA) or a similar dependency-scanning activity. This will enumerate the full dependency tree and compare component versions against vulnerability databases (e.g., CVE, NVD), allowing the team to determine whether safer versions or compensating controls are required before deployment. Compiler-hardening flags and code obfuscation can add defense-in-depth later, but they do not reveal known flaws already present in the library. Performance benchmarking, while important for capacity planning, does nothing to identify or mitigate security weaknesses.