easyMultiple ChoiceObjective-mapped
CISSP Practice Question: A development team heavily uses third-party…
A development team heavily uses third-party libraries. What is the most effective way to manage vulnerabilities in these libraries?
⚠ Common exam trap
Many exam-takers choose Option A, mistakenly believing that 'trusted sources' are vulnerability-free, when in fact all libraries can have undiscovered vulnerabilities, and the CISSP exam emphasizes continuous risk management over static trust.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a Software Composition Analysis (SCA) tool and monitor CVE databases
Software Composition Analysis (SCA) tools automate the identification of third-party libraries and their versions, cross-referencing them against known vulnerability databases such as the National Vulnerability Database (NVD) and Common Vulnerabilities and Exposures (CVE) lists. This provides continuous monitoring and alerting for newly disclosed vulnerabilities, which is the most effective and scalable approach for managing the large number of dependencies in modern development. Manual review or ignoring vulnerabilities is impractical and insecure, while relying on 'no known vulnerabilities' is a false premise.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Only use libraries from sources with no known vulnerabilities
Why it's wrong here
This approach is fundamentally unrealistic and impossible to achieve in practice. All software, especially complex third-party libraries, can contain undiscovered vulnerabilities, and even reputable sources may have vulnerabilities that are not yet publicly known or have not been patched. Relying solely on the absence of *known* vulnerabilities from a source does not guarantee security and would severely limit the adoption of essential libraries, hindering development.
- ✗
Ignore vulnerabilities unless a known exploit exists
Why it's wrong here
Ignoring vulnerabilities until a known exploit exists is a highly reactive and dangerous security posture that leaves the application unnecessarily exposed. This approach creates a significant window of vulnerability between the public disclosure of a flaw and the development of an exploit, during which the application remains susceptible to attack. Proactive identification and remediation of vulnerabilities, even without a public exploit, are crucial to minimize the attack surface and reduce overall risk.
- ✗
Manually review each library's source code for flaws
Why it's wrong here
Manually reviewing the source code of every third-party library for flaws is an impractical and unsustainable approach for most modern development teams. Applications often incorporate hundreds or thousands of libraries, each potentially comprising millions of lines of code. The sheer volume and complexity make comprehensive manual review infeasible, highly error-prone, and would drastically impede development velocity and time-to-market.
- ✓
Use a Software Composition Analysis (SCA) tool and monitor CVE databases
Why this is correct
Utilizing a Software Composition Analysis (SCA) tool combined with continuous monitoring of CVE databases represents the most effective and practical strategy for managing third-party library vulnerabilities. SCA tools automate the process of identifying all third-party components within an application, cross-referencing them against comprehensive vulnerability databases like the National Vulnerability Database (NVD) for known Common Vulnerabilities and Exposures (CVEs). This proactive approach ensures that newly disclosed vulnerabilities in integrated libraries are promptly identified, enabling timely patching or mitigation before they can be exploited.
Go deeper
Related to this question
Learn chapter
Software Development Security
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
Key term
Identification
Identification is the process where a user or device claims an identity, often by providing a username, ID number, or account name, before proving that claim with authentication.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.