CISSP Software Development Security Practice Question
A development team is using a third-party library that is known to have a critical vulnerability. The team decides to continue using the library because it is widely used and the vulnerability has not been exploited. Which security risk is the team ignoring?
⚠ Common exam trap
Many candidates think 'no exploitation yet' means the risk is acceptable, but CISSP tests the principle that known vulnerabilities must be remediated regardless of current exploit status, as threat actors will eventually weaponize them.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Using components with known vulnerabilities
The team is ignoring the risk of using components with known vulnerabilities, which is explicitly listed in the OWASP Top 10 (A06:2021). Even if a vulnerability has not been exploited yet, continuing to use a library with a known CVE (e.g., a remote code execution flaw in an older version of Log4j) exposes the application to potential attacks once exploit code becomes public. The decision based on 'wide usage' and 'no exploitation so far' is a fallacy, as threat actors often target widely deployed libraries precisely because of their large attack surface.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Insecure deserialization
Why it's wrong here
Insecure deserialization occurs when an application deserializes untrusted data without proper validation, potentially leading to remote code execution or denial of service. The scenario describes a library with an inherent vulnerability, not specifically an issue arising from the unsafe reconstruction of data objects from a serialized format. The core problem is the component's existence, not its deserialization practices.
- ✗
Insufficient logging and monitoring
Why it's wrong here
Insufficient logging and monitoring refers to the absence or inadequacy of security event records and the systems to analyze them, hindering detection of attacks. While crucial for incident response, this issue does not address the fundamental problem of introducing a known vulnerable component into the codebase. The vulnerability exists regardless of whether its exploitation is logged or monitored, making it a reactive rather than a preventative concern.
- ✓
Using components with known vulnerabilities
Why this is correct
This option precisely describes the scenario where a development team incorporates a third-party library that contains publicly disclosed security flaws. Such components, often found in open-source libraries or commercial software, introduce significant risk because attackers can exploit these known weaknesses. Proactively identifying and remediating these vulnerabilities, typically through patching or replacement, is critical for maintaining application security posture.
- ✗
Security misconfiguration
Why it's wrong here
Security misconfiguration involves improper setup of security controls, such as using default credentials, leaving unnecessary services enabled, or having overly permissive access controls. The problem in the question stem is an intrinsic flaw within the third-party library's code itself, not an incorrect configuration or deployment setting applied by the development team. The library is inherently vulnerable, irrespective of how it is configured.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Threat
A threat is any potential danger that could harm a computer system, network, or data, whether from a malicious hacker, a natural disaster, or an accidental mistake.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.