mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: A financial application uses a third-party…
A financial application uses a third-party library for PDF generation. A security review finds that the library is no longer maintained and has known vulnerabilities. What is the BEST course of action?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Replace the library with a maintained alternative.
The best course of action because replacing the library with a maintained alternative directly addresses the root cause of using an unmaintained library with known vulnerabilities. Option A is not the best because restricting network access reduces exposure but does not fix the underlying vulnerabilities. Option B is not the best because encrypting PDF files protects the content but does not prevent exploitation of the library. Option C is not the best because a web application firewall can mitigate some attacks but is not a comprehensive solution for known vulnerabilities in the library.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Restrict network access to the PDF server.
Why it's wrong here
Restricting network access to the PDF server is a perimeter control that limits the exposure of the vulnerable component to external threats. However, this action does not address the fundamental flaw within the third-party PDF generation library itself. The vulnerability would still exist internally, potentially exploitable by an insider threat or if an attacker gains initial access through another vector, rendering the network restriction ineffective against the root cause.
- ✗
Encrypt all PDF files after generation.
Why it's wrong here
Encrypting all PDF files after generation protects the confidentiality and integrity of the data at rest. While crucial for data protection, this measure does not prevent the exploitation of a vulnerability within the PDF generation library during its execution. An attacker could still leverage the library's flaw to achieve remote code execution, data exfiltration before encryption, or denial of service, irrespective of the subsequent encryption of the output files.
- ✗
Implement a web application firewall to block attacks targeting the library.
Why it's wrong here
Implementing a web application firewall (WAF) provides a layer of defense by inspecting and filtering incoming web traffic for malicious patterns. A WAF can offer reactive mitigation against known attack signatures targeting the library; however, it does not remove the inherent vulnerability from the library's code. This approach leaves the system susceptible to zero-day exploits or sophisticated evasion techniques that bypass WAF detection, failing to provide a permanent solution to the underlying flaw.
- ✓
Replace the library with a maintained alternative.
Why this is correct
Replacing the vulnerable third-party library with a well-maintained and secure alternative directly addresses the root cause of the security flaw. This action permanently removes the insecure code from the application's codebase, thereby eliminating the specific vulnerability that could be exploited. This proactive remediation strategy is the most effective way to ensure the long-term security and integrity of the financial application against this particular threat.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Web Application Firewall
A Web Application Firewall (WAF) is a security tool that monitors, filters, and blocks HTTP traffic to and from a web application to protect it from common attacks.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.