CISSP Software Development Security Practice Question
An organization is acquiring a third-party software product. Which THREE of the following should be included in the security assessment of the vendor?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Vulnerability scanning of dependencies
Reviewing the SBOM, vulnerability scanning of dependencies, and vendor security assessments are key elements of third-party security evaluation. Code signing is a deployment control, not assessment; license compliance is legal but not security-specific.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Vulnerability scanning of dependencies
Why this is correct
Vulnerability scanning of dependencies is a critical security measure when acquiring third-party software. Modern applications extensively rely on open-source and commercial libraries, which frequently contain known vulnerabilities (CVEs). Scanning tools automate the process of identifying these susceptible components by comparing them against comprehensive vulnerability databases, providing an essential and immediate assessment of the acquired product's underlying security posture and potential exploitability.
- ✓
Reviewing the Software Bill of Materials (SBOM)
Why this is correct
Reviewing the Software Bill of Materials (SBOM) is a fundamental practice for understanding the composition of acquired software. An SBOM provides a machine-readable inventory of all software components, including open-source and proprietary elements, used in a product. This transparency allows the acquiring organization to proactively identify potential licensing issues, cross-reference components against known vulnerability databases, and gain a comprehensive understanding of the software's supply chain for effective risk management and future vulnerability tracking.
- ✗
Verifying software license compliance
Why it's wrong here
While essential for legal and contractual adherence, verifying software license compliance primarily addresses intellectual property rights and contractual obligations rather than the inherent security of the software itself. This activity ensures the acquiring organization adheres to the terms of use, preventing legal repercussions or financial penalties. However, it does not directly assess or improve the security posture, vulnerability profile, or operational resilience of the acquired software product, making it distinct from direct security assessment activities.
- ✓
Performing a vendor security assessment
Why this is correct
Performing a vendor security assessment is a comprehensive approach to evaluating the third-party vendor's overall security posture and operational maturity. This assessment scrutinizes their development practices, incident response capabilities, data protection policies, and adherence to security compliance frameworks. Understanding the vendor's commitment to security throughout their software development lifecycle and operational management helps determine the residual risk associated with using their product and ensures alignment with the acquiring organization's security requirements.
- ✗
Ensuring code signing is used in the vendor's development process
Why it's wrong here
Ensuring code signing is used in the vendor's development process is a specific technical control for maintaining software integrity, but it is not a primary initial acquisition assessment activity. Code signing cryptographically verifies the authenticity and integrity of software, confirming it has not been tampered with since its release by the developer. While crucial for deployment and runtime security, this is a post-development control that verifies the software's state at release, rather than assessing the inherent vulnerabilities within the code or the vendor's broader security practices during the initial acquisition phase.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.