mediumMultiple ChoiceObjective-mapped
CCSP Practice Question: In a DevSecOps pipeline for a cloud application,…
In a DevSecOps pipeline for a cloud application, which practice best ensures that only approved open-source components are used?
⚠ Common exam trap
ISC2 often tests the distinction between detection tools (like Snyk or SAST) and enforcement controls (like allow-lists), so candidates mistakenly choose a scanning tool that finds vulnerabilities rather than a policy-based mechanism that prevents unapproved components from being used at all.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Using a private artifact registry with allow-lists
A private artifact registry with allow-lists enforces a whitelist of approved open-source components, preventing developers from pulling unvetted dependencies directly from public repositories. This ensures that only components that have passed security and compliance reviews are used in the pipeline, directly addressing the requirement for 'approved' open-source components.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Signing container images
Why it's wrong here
Image signing ensures integrity but doesn't control package sources.
- ✗
Implementing dependency scanning with Snyk
Why it's wrong here
Dependency scanning identifies vulnerabilities but doesn't block unapproved packages.
- ✓
Using a private artifact registry with allow-lists
Why this is correct
A private registry restricts dependencies to those approved.
- ✗
Running SAST scans on all source code
Why it's wrong here
SAST scans source code, but doesn't control dependency sources.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.