mediumMultiple Choice
CISSP Practice Question: A financial application uses a third-party…
A financial application uses a third-party library for PDF generation. A security review finds that the library is no longer maintained and has known vulnerabilities. What is the BEST course of action?
⚠ Common exam trap
The trap is choosing a compensating control (WAF, network restriction) because it seems quicker — but CISSP always prefers eliminating the root cause when feasible.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Replace the library with a maintained alternative.
Replacing the unmaintained library with a maintained alternative is the best action because it eliminates the root cause: known vulnerabilities in code you cannot patch. A maintained library receives security updates, so the risk is removed rather than mitigated. Compensating controls like network restrictions or WAFs do not fix the underlying vulnerable code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Restrict network access to the PDF server.
Why it's wrong here
Restricting network access to the PDF server is a perimeter control that limits the exposure of the vulnerable component to external threats. However, this action does not address the fundamental flaw within the third-party PDF generation library itself. The vulnerability would still exist internally, potentially exploitable by an insider threat or if an attacker gains initial access through another vector, rendering the network restriction ineffective against the root cause.
- ✗
Encrypt all PDF files after generation.
Why it's wrong here
Encrypting all PDF files after generation protects the confidentiality and integrity of the data at rest. While crucial for data protection, this measure does not prevent the exploitation of a vulnerability within the PDF generation library during its execution. An attacker could still leverage the library's flaw to achieve remote code execution, data exfiltration before encryption, or denial of service, irrespective of the subsequent encryption of the output files.
- ✗
Implement a web application firewall to block attacks targeting the library.
Why it's wrong here
Implementing a web application firewall (WAF) provides a layer of defense by inspecting and filtering incoming web traffic for malicious patterns. A WAF can offer reactive mitigation against known attack signatures targeting the library; however, it does not remove the inherent vulnerability from the library's code. This approach leaves the system susceptible to zero-day exploits or sophisticated evasion techniques that bypass WAF detection, failing to provide a permanent solution to the underlying flaw.
- ✓
Replace the library with a maintained alternative.
Why this is correct
Replacing the vulnerable third-party library with a well-maintained and secure alternative directly addresses the root cause of the security flaw. This action permanently removes the insecure code from the application's codebase, thereby eliminating the specific vulnerability that could be exploited. This proactive remediation strategy is the most effective way to ensure the long-term security and integrity of the financial application against this particular threat.
Go deeper
Related to this question
Learn chapter
Secure Network Architecture and Components
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.