ISC2 CISSP Development Ecosystems CI_CD Repositories And Application Testing Practice Test

 

8 Software Development Security • 27 original questions

This CISSP practice test focuses on development ecosystems ci_cd repositories and application testing through original scenario-based questions aligned to the current ISC2 CISSP Certification Exam Outline. Use the full ExamSnap CISSP collection for practice across all eight domains. For broader exam preparation, review the ISC2 CISSP Exam Dumps page.

Instructions: Select the best answer for each question. Review the explanation after answering; each distractor includes a reason it is not the best choice for that scenario.

Question 1

Adventure Works is standardizing security across several business units. The customer identity platform raises a question about Runtime. The security governance lead needs to address the control objective while maintaining the organization’s stated risk appetite. Which action provides the BEST governance and security outcome? The delivery organization releases changes through 2 application or service pipelines.

1. Deploy a new security product immediately before confirming scope, ownership, or the required security outcome.
2. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.
3. Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks.
4. Embed security requirements, threat analysis, testing, approval, and change control throughout the chosen SDLC methodology and into maintenance.

Correct answer: C

Why: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Runtime while maintaining the organization’s stated risk appetite.

Option review:

A: A product-first response can add complexity without proving that the actual governance, risk, or control requirement is satisfied. That action can be useful in a different security decision, but it does not most directly address Runtime in this scenario.

B: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. That action can be useful in a different security decision, but it does not most directly address Runtime in this scenario.

C: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Runtime while maintaining the organization’s stated risk appetite.

D: Security is most effective when it is integrated into delivery rather than added as a final gate. That action can be useful in a different security decision, but it does not most directly address Runtime in this scenario.

Learning point: Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks. Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end.

Question 2

During a internal audit response, VanArsdel Energy asks the IAM architect to address Continuous Integration and Continuous Delivery (CI/CD) for its data analytics lake. The requirement is to address the control objective while meeting the business objective with the least unnecessary operational complexity. What should the organization do FIRST? The delivery organization releases changes through 8 application or service pipelines.

1. Grant a small operations group broad administrator access so they can work around the issue whenever it appears.
2. Protect the CI/CD pipeline with least-privilege identities, signed or verified artifacts, controlled secrets, and automated security gates.
3. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.
4. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.

Correct answer: B

Why: A compromised pipeline can turn trusted delivery automation into a software-supply-chain attack path. It directly addresses Continuous Integration and Continuous Delivery (CI/CD) while meeting the business objective with the least unnecessary operational complexity.

Option review:

A: Broad standing privilege conflicts with least privilege and treats symptoms rather than fixing the underlying control design. That action can be useful in a different security decision, but it does not most directly address Continuous Integration and Continuous Delivery (CI/CD) in this scenario.

B: A compromised pipeline can turn trusted delivery automation into a software-supply-chain attack path. It directly addresses Continuous Integration and Continuous Delivery (CI/CD) while meeting the business objective with the least unnecessary operational complexity.

C: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. That action can be useful in a different security decision, but it does not most directly address Continuous Integration and Continuous Delivery (CI/CD) in this scenario.

D: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. That action can be useful in a different security decision, but it does not most directly address Continuous Integration and Continuous Delivery (CI/CD) in this scenario.

Learning point: Protect the CI/CD pipeline with least-privilege identities, signed or verified artifacts, controlled secrets, and automated security gates. A compromised pipeline can turn trusted delivery automation into a software-supply-chain attack path.

Question 3

Northwind Health is revising controls for its branch-office network. A review highlights Software configuration management (CM). The application security architect must address the control objective while keeping the control sustainable for normal operations. Which action is the BEST next step? The delivery organization releases changes through 9 application or service pipelines.

1. Document the risk as accepted without identifying an accountable risk owner or evaluating residual impact.
2. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.
3. Embed security requirements, threat analysis, testing, approval, and change control throughout the chosen SDLC methodology and into maintenance.
4. Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks.

Correct answer: D

Why: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Software configuration management (CM) while keeping the control sustainable for normal operations.

Option review:

A: Risk acceptance is a business decision that requires informed ownership and cannot substitute for analysis. That action can be useful in a different security decision, but it does not most directly address Software configuration management (CM) in this scenario.

B: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. That action can be useful in a different security decision, but it does not most directly address Software configuration management (CM) in this scenario.

C: Security is most effective when it is integrated into delivery rather than added as a final gate. That action can be useful in a different security decision, but it does not most directly address Software configuration management (CM) in this scenario.

D: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Software configuration management (CM) while keeping the control sustainable for normal operations.

Learning point: Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks. Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end.

Question 4

An auditor asks Coho Insurance to demonstrate how it handles Code repositories in the industrial control network. The incident response manager must address the control objective while ensuring the decision can be repeated consistently across business units. Which response is MOST appropriate? The delivery organization releases changes through 2 application or service pipelines.

1. Embed security requirements, threat analysis, testing, approval, and change control throughout the chosen SDLC methodology and into maintenance.
2. Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks.
3. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.
4. Rely on a manual checklist performed during emergencies instead of establishing a repeatable preventive or detective control.

Correct answer: B

Why: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Code repositories while ensuring the decision can be repeated consistently across business units.

Option review:

A: Security is most effective when it is integrated into delivery rather than added as a final gate. That action can be useful in a different security decision, but it does not most directly address Code repositories in this scenario.

B: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Code repositories while ensuring the decision can be repeated consistently across business units.

C: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. That action can be useful in a different security decision, but it does not most directly address Code repositories in this scenario.

D: Manual emergency workarounds are fragile and do not provide the consistent assurance required by the scenario. That action can be useful in a different security decision, but it does not most directly address Code repositories in this scenario.

Learning point: Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks. Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end.

Question 5

After a business change, A. Datum Analytics discovers that Static Application Security Testing (SAST) is not handled consistently for the research data repository. The security governance lead needs to address the control objective while preserving clear accountability and audit evidence. Which recommendation BEST addresses the issue? The delivery organization releases changes through 3 application or service pipelines.

1. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.
2. Deploy a new security product immediately before confirming scope, ownership, or the required security outcome.
3. Embed security requirements, threat analysis, testing, approval, and change control throughout the chosen SDLC methodology and into maintenance.
4. Run SAST early in the pipeline on source or intermediate code and require remediation of high-risk findings before release.

Correct answer: D

Why: SAST finds code-level weaknesses without executing the application and is effective early in development. It directly addresses Static Application Security Testing (SAST) while preserving clear accountability and audit evidence.

Option review:

A: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. That action can be useful in a different security decision, but it does not most directly address Static Application Security Testing (SAST) in this scenario.

B: A product-first response can add complexity without proving that the actual governance, risk, or control requirement is satisfied. That action can be useful in a different security decision, but it does not most directly address Static Application Security Testing (SAST) in this scenario.

C: Security is most effective when it is integrated into delivery rather than added as a final gate. That action can be useful in a different security decision, but it does not most directly address Static Application Security Testing (SAST) in this scenario.

D: SAST finds code-level weaknesses without executing the application and is effective early in development. It directly addresses Static Application Security Testing (SAST) while preserving clear accountability and audit evidence.

Learning point: Run SAST early in the pipeline on source or intermediate code and require remediation of high-risk findings before release. SAST finds code-level weaknesses without executing the application and is effective early in development.

Question 6

Blue Yonder Airlines is preparing a security decision for the payment processing service. The decision involves Dynamic Application Security Testing (DAST). The IAM architect must address the control objective while protecting sensitive data throughout the change. Which option BEST reflects CISSP-level security practice? The delivery organization releases changes through 4 application or service pipelines.

1. Run DAST against a running application in an appropriate test environment to identify runtime and externally observable weaknesses.
2. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.
3. Grant a small operations group broad administrator access so they can work around the issue whenever it appears.
4. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.

Correct answer: A

Why: DAST evaluates the behavior of an executing application from the outside. It directly addresses Dynamic Application Security Testing (DAST) while protecting sensitive data throughout the change.

Option review:

A: DAST evaluates the behavior of an executing application from the outside. It directly addresses Dynamic Application Security Testing (DAST) while protecting sensitive data throughout the change.

B: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. That action can be useful in a different security decision, but it does not most directly address Dynamic Application Security Testing (DAST) in this scenario.

C: Broad standing privilege conflicts with least privilege and treats symptoms rather than fixing the underlying control design. That action can be useful in a different security decision, but it does not most directly address Dynamic Application Security Testing (DAST) in this scenario.

D: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. That action can be useful in a different security decision, but it does not most directly address Dynamic Application Security Testing (DAST) in this scenario.

Learning point: Run DAST against a running application in an appropriate test environment to identify runtime and externally observable weaknesses. DAST evaluates the behavior of an executing application from the outside.

Question 7

During a risk workshop for the software delivery pipeline, the team identifies Software Composition Analysis (SCA) as the deciding issue. The application security architect is expected to address the control objective while preserving availability of the critical business service. What is the MOST appropriate course of action? The delivery organization releases changes through 2 application or service pipelines.

1. Document the risk as accepted without identifying an accountable risk owner or evaluating residual impact.
2. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.
3. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
4. Use software composition analysis and dependency governance to identify vulnerable or prohibited third-party components.

Correct answer: D

Why: SCA focuses on third-party and open-source dependency risk. It directly addresses Software Composition Analysis (SCA) while preserving availability of the critical business service.

Option review:

A: Risk acceptance is a business decision that requires informed ownership and cannot substitute for analysis. That action can be useful in a different security decision, but it does not most directly address Software Composition Analysis (SCA) in this scenario.

B: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. That action can be useful in a different security decision, but it does not most directly address Software Composition Analysis (SCA) in this scenario.

C: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. That action can be useful in a different security decision, but it does not most directly address Software Composition Analysis (SCA) in this scenario.

D: SCA focuses on third-party and open-source dependency risk. It directly addresses Software Composition Analysis (SCA) while preserving availability of the critical business service.

Learning point: Use software composition analysis and dependency governance to identify vulnerable or prohibited third-party components. SCA focuses on third-party and open-source dependency risk.

Question 8

A control owner at Tailspin Logistics proposes a quick technical fix for Interactive Application Security Testing (IAST) in the AI-assisted customer service platform. The incident response manager must address the control objective without replacing governance with a technology-only shortcut. What should happen FIRST? The delivery organization releases changes through 3 application or service pipelines.

1. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
2. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.
3. Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks.
4. Rely on a manual checklist performed during emergencies instead of establishing a repeatable preventive or detective control.

Correct answer: C

Why: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Interactive Application Security Testing (IAST) without replacing governance with a technology-only shortcut.

Option review:

A: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. That action can be useful in a different security decision, but it does not most directly address Interactive Application Security Testing (IAST) in this scenario.

B: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. That action can be useful in a different security decision, but it does not most directly address Interactive Application Security Testing (IAST) in this scenario.

C: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Interactive Application Security Testing (IAST) without replacing governance with a technology-only shortcut.

D: Manual emergency workarounds are fragile and do not provide the consistent assurance required by the scenario. That action can be useful in a different security decision, but it does not most directly address Interactive Application Security Testing (IAST) in this scenario.

Learning point: Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks. Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end.

Question 9

Alpine Sports is standardizing security across several business units. The global collaboration platform raises a question about Programming languages. The security governance lead needs to address the control objective while keeping the process defensible to auditors and business owners. Which action provides the BEST governance and security outcome? The delivery organization releases changes through 4 application or service pipelines.

1. Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks.
2. Deploy a new security product immediately before confirming scope, ownership, or the required security outcome.
3. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
4. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.

Correct answer: A

Why: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Programming languages while keeping the process defensible to auditors and business owners.

Option review:

A: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Programming languages while keeping the process defensible to auditors and business owners.

B: A product-first response can add complexity without proving that the actual governance, risk, or control requirement is satisfied. That action can be useful in a different security decision, but it does not most directly address Programming languages in this scenario.

C: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. That action can be useful in a different security decision, but it does not most directly address Programming languages in this scenario.

D: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. That action can be useful in a different security decision, but it does not most directly address Programming languages in this scenario.

Learning point: Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks. Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end.

Question 10

During a identity modernization project, Fabrikam Manufacturing asks the IAM architect to address Libraries for its e-commerce application. The requirement is to address the control objective while minimizing irreversible action until facts and authority are established. What should the organization do FIRST? The delivery organization releases changes through 5 application or service pipelines.

1. Use software composition analysis and dependency governance to identify vulnerable or prohibited third-party components.
2. Grant a small operations group broad administrator access so they can work around the issue whenever it appears.
3. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.
4. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.

Correct answer: A

Why: SCA focuses on third-party and open-source dependency risk. It directly addresses Libraries while minimizing irreversible action until facts and authority are established.

Option review:

A: SCA focuses on third-party and open-source dependency risk. It directly addresses Libraries while minimizing irreversible action until facts and authority are established.

B: Broad standing privilege conflicts with least privilege and treats symptoms rather than fixing the underlying control design. That action can be useful in a different security decision, but it does not most directly address Libraries in this scenario.

C: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. That action can be useful in a different security decision, but it does not most directly address Libraries in this scenario.

D: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. That action can be useful in a different security decision, but it does not most directly address Libraries in this scenario.

Learning point: Use software composition analysis and dependency governance to identify vulnerable or prohibited third-party components. SCA focuses on third-party and open-source dependency risk.

Question 11

Trey Research is revising controls for its clinical records environment. A review highlights Tool sets. The application security architect must address the control objective while preserving evidence needed for later review. Which action is the BEST next step? The delivery organization releases changes through 6 application or service pipelines.

1. Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks.
2. Document the risk as accepted without identifying an accountable risk owner or evaluating residual impact.
3. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.
4. Embed security requirements, threat analysis, testing, approval, and change control throughout the chosen SDLC methodology and into maintenance.

Correct answer: A

Why: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Tool sets while preserving evidence needed for later review.

Option review:

A: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Tool sets while preserving evidence needed for later review.

B: Risk acceptance is a business decision that requires informed ownership and cannot substitute for analysis. That action can be useful in a different security decision, but it does not most directly address Tool sets in this scenario.

C: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. That action can be useful in a different security decision, but it does not most directly address Tool sets in this scenario.

D: Security is most effective when it is integrated into delivery rather than added as a final gate. That action can be useful in a different security decision, but it does not most directly address Tool sets in this scenario.

Learning point: Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks. Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end.

Question 12

An auditor asks Margie Travel to demonstrate how it handles Integrated Development Environment (IDE) in the remote access service. The incident response manager must address the control objective without granting broader privilege than the business need requires. Which response is MOST appropriate? The delivery organization releases changes through 7 application or service pipelines.

1. Rely on a manual checklist performed during emergencies instead of establishing a repeatable preventive or detective control.
2. Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks.
3. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
4. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.

Correct answer: B

Why: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Integrated Development Environment (IDE) without granting broader privilege than the business need requires.

Option review:

A: Manual emergency workarounds are fragile and do not provide the consistent assurance required by the scenario. That action can be useful in a different security decision, but it does not most directly address Integrated Development Environment (IDE) in this scenario.

B: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Integrated Development Environment (IDE) without granting broader privilege than the business need requires.

C: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. That action can be useful in a different security decision, but it does not most directly address Integrated Development Environment (IDE) in this scenario.

D: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. That action can be useful in a different security decision, but it does not most directly address Integrated Development Environment (IDE) in this scenario.

Learning point: Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks. Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end.

Question 13

After a business change, Wide World Importers discovers that Runtime is not handled consistently for the customer identity platform. The security governance lead needs to address the control objective without creating a new single point of failure. Which recommendation BEST addresses the issue? The delivery organization releases changes through 5 application or service pipelines.

1. Deploy a new security product immediately before confirming scope, ownership, or the required security outcome.
2. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
3. Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks.
4. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.

Correct answer: C

Why: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Runtime without creating a new single point of failure.

Option review:

A: A product-first response can add complexity without proving that the actual governance, risk, or control requirement is satisfied. That action can be useful in a different security decision, but it does not most directly address Runtime in this scenario.

B: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. That action can be useful in a different security decision, but it does not most directly address Runtime in this scenario.

C: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Runtime without creating a new single point of failure.

D: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. That action can be useful in a different security decision, but it does not most directly address Runtime in this scenario.

Learning point: Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks. Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end.

Question 14

Bellows University is preparing a security decision for the data analytics lake. The decision involves Continuous Integration and Continuous Delivery (CI/CD). The IAM architect must address the control objective while ensuring that emergency access cannot become permanent access. Which option BEST reflects CISSP-level security practice? The delivery organization releases changes through 6 application or service pipelines.

1. Grant a small operations group broad administrator access so they can work around the issue whenever it appears.
2. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
3. Protect the CI/CD pipeline with least-privilege identities, signed or verified artifacts, controlled secrets, and automated security gates.
4. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.

Correct answer: C

Why: A compromised pipeline can turn trusted delivery automation into a software-supply-chain attack path. It directly addresses Continuous Integration and Continuous Delivery (CI/CD) while ensuring that emergency access cannot become permanent access.

Option review:

A: Broad standing privilege conflicts with least privilege and treats symptoms rather than fixing the underlying control design. That action can be useful in a different security decision, but it does not most directly address Continuous Integration and Continuous Delivery (CI/CD) in this scenario.

B: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. That action can be useful in a different security decision, but it does not most directly address Continuous Integration and Continuous Delivery (CI/CD) in this scenario.

C: A compromised pipeline can turn trusted delivery automation into a software-supply-chain attack path. It directly addresses Continuous Integration and Continuous Delivery (CI/CD) while ensuring that emergency access cannot become permanent access.

D: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. That action can be useful in a different security decision, but it does not most directly address Continuous Integration and Continuous Delivery (CI/CD) in this scenario.

Learning point: Protect the CI/CD pipeline with least-privilege identities, signed or verified artifacts, controlled secrets, and automated security gates. A compromised pipeline can turn trusted delivery automation into a software-supply-chain attack path.

Question 15

During a risk workshop for the branch-office network, the team identifies Software configuration management (CM) as the deciding issue. The application security architect is expected to address the control objective while allowing independent verification of the control outcome. What is the MOST appropriate course of action? The delivery organization releases changes through 7 application or service pipelines.

1. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.
2. Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks.
3. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
4. Document the risk as accepted without identifying an accountable risk owner or evaluating residual impact.

Correct answer: B

Why: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Software configuration management (CM) while allowing independent verification of the control outcome.

Option review:

A: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. That action can be useful in a different security decision, but it does not most directly address Software configuration management (CM) in this scenario.

B: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Software configuration management (CM) while allowing independent verification of the control outcome.

C: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. That action can be useful in a different security decision, but it does not most directly address Software configuration management (CM) in this scenario.

D: Risk acceptance is a business decision that requires informed ownership and cannot substitute for analysis. That action can be useful in a different security decision, but it does not most directly address Software configuration management (CM) in this scenario.

Learning point: Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks. Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end.

Question 16

A control owner at Humongous Insurance proposes a quick technical fix for Code repositories in the industrial control network. The incident response manager must address the control objective while accounting for third-party and lifecycle dependencies. What should happen FIRST? The delivery organization releases changes through 8 application or service pipelines.

1. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.
2. Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks.
3. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.
4. Rely on a manual checklist performed during emergencies instead of establishing a repeatable preventive or detective control.

Correct answer: B

Why: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Code repositories while accounting for third-party and lifecycle dependencies.

Option review:

A: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. That action can be useful in a different security decision, but it does not most directly address Code repositories in this scenario.

B: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Code repositories while accounting for third-party and lifecycle dependencies.

C: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. That action can be useful in a different security decision, but it does not most directly address Code repositories in this scenario.

D: Manual emergency workarounds are fragile and do not provide the consistent assurance required by the scenario. That action can be useful in a different security decision, but it does not most directly address Code repositories in this scenario.

Learning point: Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks. Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end.

Question 17

Woodgrove Bank is standardizing security across several business units. The research data repository raises a question about Static Application Security Testing (SAST). The security governance lead needs to address the control objective while maintaining the organization’s stated risk appetite. Which action provides the BEST governance and security outcome? The delivery organization releases changes through 9 application or service pipelines.

1. Deploy a new security product immediately before confirming scope, ownership, or the required security outcome.
2. Run SAST early in the pipeline on source or intermediate code and require remediation of high-risk findings before release.
3. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
4. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.

Correct answer: B

Why: SAST finds code-level weaknesses without executing the application and is effective early in development. It directly addresses Static Application Security Testing (SAST) while maintaining the organization’s stated risk appetite.

Option review:

A: A product-first response can add complexity without proving that the actual governance, risk, or control requirement is satisfied. That action can be useful in a different security decision, but it does not most directly address Static Application Security Testing (SAST) in this scenario.

B: SAST finds code-level weaknesses without executing the application and is effective early in development. It directly addresses Static Application Security Testing (SAST) while maintaining the organization’s stated risk appetite.

C: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. That action can be useful in a different security decision, but it does not most directly address Static Application Security Testing (SAST) in this scenario.

D: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. That action can be useful in a different security decision, but it does not most directly address Static Application Security Testing (SAST) in this scenario.

Learning point: Run SAST early in the pipeline on source or intermediate code and require remediation of high-risk findings before release. SAST finds code-level weaknesses without executing the application and is effective early in development.

Question 18

During a architecture design review, Relecloud Systems asks the IAM architect to address Dynamic Application Security Testing (DAST) for its payment processing service. The requirement is to address the control objective while meeting the business objective with the least unnecessary operational complexity. What should the organization do FIRST? The delivery organization releases changes through 7 application or service pipelines.

1. Embed security requirements, threat analysis, testing, approval, and change control throughout the chosen SDLC methodology and into maintenance.
2. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
3. Grant a small operations group broad administrator access so they can work around the issue whenever it appears.
4. Run DAST against a running application in an appropriate test environment to identify runtime and externally observable weaknesses.

Correct answer: D

Why: DAST evaluates the behavior of an executing application from the outside. It directly addresses Dynamic Application Security Testing (DAST) while meeting the business objective with the least unnecessary operational complexity.

Option review:

A: Security is most effective when it is integrated into delivery rather than added as a final gate. That action can be useful in a different security decision, but it does not most directly address Dynamic Application Security Testing (DAST) in this scenario.

B: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. That action can be useful in a different security decision, but it does not most directly address Dynamic Application Security Testing (DAST) in this scenario.

C: Broad standing privilege conflicts with least privilege and treats symptoms rather than fixing the underlying control design. That action can be useful in a different security decision, but it does not most directly address Dynamic Application Security Testing (DAST) in this scenario.

D: DAST evaluates the behavior of an executing application from the outside. It directly addresses Dynamic Application Security Testing (DAST) while meeting the business objective with the least unnecessary operational complexity.

Learning point: Run DAST against a running application in an appropriate test environment to identify runtime and externally observable weaknesses. DAST evaluates the behavior of an executing application from the outside.

Question 19

Contoso Financial is revising controls for its software delivery pipeline. A review highlights Software Composition Analysis (SCA). The application security architect must address the control objective while keeping the control sustainable for normal operations. Which action is the BEST next step? The delivery organization releases changes through 8 application or service pipelines.

1. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.
2. Document the risk as accepted without identifying an accountable risk owner or evaluating residual impact.
3. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.
4. Use software composition analysis and dependency governance to identify vulnerable or prohibited third-party components.

Correct answer: D

Why: SCA focuses on third-party and open-source dependency risk. It directly addresses Software Composition Analysis (SCA) while keeping the control sustainable for normal operations.

Option review:

A: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. That action can be useful in a different security decision, but it does not most directly address Software Composition Analysis (SCA) in this scenario.

B: Risk acceptance is a business decision that requires informed ownership and cannot substitute for analysis. That action can be useful in a different security decision, but it does not most directly address Software Composition Analysis (SCA) in this scenario.

C: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. That action can be useful in a different security decision, but it does not most directly address Software Composition Analysis (SCA) in this scenario.

D: SCA focuses on third-party and open-source dependency risk. It directly addresses Software Composition Analysis (SCA) while keeping the control sustainable for normal operations.

Learning point: Use software composition analysis and dependency governance to identify vulnerable or prohibited third-party components. SCA focuses on third-party and open-source dependency risk.

Question 20

An auditor asks Lucerne Publishing to demonstrate how it handles Interactive Application Security Testing (IAST) in the AI-assisted customer service platform. The incident response manager must address the control objective while ensuring the decision can be repeated consistently across business units. Which response is MOST appropriate? The delivery organization releases changes through 9 application or service pipelines.

1. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
2. Rely on a manual checklist performed during emergencies instead of establishing a repeatable preventive or detective control.
3. Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks.
4. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.

Correct answer: C

Why: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Interactive Application Security Testing (IAST) while ensuring the decision can be repeated consistently across business units.

Option review:

A: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. That action can be useful in a different security decision, but it does not most directly address Interactive Application Security Testing (IAST) in this scenario.

B: Manual emergency workarounds are fragile and do not provide the consistent assurance required by the scenario. That action can be useful in a different security decision, but it does not most directly address Interactive Application Security Testing (IAST) in this scenario.

C: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Interactive Application Security Testing (IAST) while ensuring the decision can be repeated consistently across business units.

D: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. That action can be useful in a different security decision, but it does not most directly address Interactive Application Security Testing (IAST) in this scenario.

Learning point: Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks. Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end.

Question 21

After a business change, Lamna Healthcare discovers that Programming languages is not handled consistently for the global collaboration platform. The security governance lead needs to address the control objective while preserving clear accountability and audit evidence. Which recommendation BEST addresses the issue? The delivery organization releases changes through 2 application or service pipelines.

1. Deploy a new security product immediately before confirming scope, ownership, or the required security outcome.
2. Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks.
3. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.
4. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.

Correct answer: B

Why: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Programming languages while preserving clear accountability and audit evidence.

Option review:

A: A product-first response can add complexity without proving that the actual governance, risk, or control requirement is satisfied. That action can be useful in a different security decision, but it does not most directly address Programming languages in this scenario.

B: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Programming languages while preserving clear accountability and audit evidence.

C: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. That action can be useful in a different security decision, but it does not most directly address Programming languages in this scenario.

D: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. That action can be useful in a different security decision, but it does not most directly address Programming languages in this scenario.

Learning point: Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks. Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end.

Question 22

Fourth Coffee is preparing a security decision for the e-commerce application. The decision involves Libraries. The IAM architect must address the control objective while protecting sensitive data throughout the change. Which option BEST reflects CISSP-level security practice? The delivery organization releases changes through 3 application or service pipelines.

1. Use software composition analysis and dependency governance to identify vulnerable or prohibited third-party components.
2. Grant a small operations group broad administrator access so they can work around the issue whenever it appears.
3. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.
4. Embed security requirements, threat analysis, testing, approval, and change control throughout the chosen SDLC methodology and into maintenance.

Correct answer: A

Why: SCA focuses on third-party and open-source dependency risk. It directly addresses Libraries while protecting sensitive data throughout the change.

Option review:

A: SCA focuses on third-party and open-source dependency risk. It directly addresses Libraries while protecting sensitive data throughout the change.

B: Broad standing privilege conflicts with least privilege and treats symptoms rather than fixing the underlying control design. That action can be useful in a different security decision, but it does not most directly address Libraries in this scenario.

C: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. That action can be useful in a different security decision, but it does not most directly address Libraries in this scenario.

D: Security is most effective when it is integrated into delivery rather than added as a final gate. That action can be useful in a different security decision, but it does not most directly address Libraries in this scenario.

Learning point: Use software composition analysis and dependency governance to identify vulnerable or prohibited third-party components. SCA focuses on third-party and open-source dependency risk.

Question 23

During a risk workshop for the clinical records environment, the team identifies Tool sets as the deciding issue. The application security architect is expected to address the control objective while preserving availability of the critical business service. What is the MOST appropriate course of action? The delivery organization releases changes through 9 application or service pipelines.

1. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.
2. Document the risk as accepted without identifying an accountable risk owner or evaluating residual impact.
3. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.
4. Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks.

Correct answer: D

Why: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Tool sets while preserving availability of the critical business service.

Option review:

A: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. That action can be useful in a different security decision, but it does not most directly address Tool sets in this scenario.

B: Risk acceptance is a business decision that requires informed ownership and cannot substitute for analysis. That action can be useful in a different security decision, but it does not most directly address Tool sets in this scenario.

C: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. That action can be useful in a different security decision, but it does not most directly address Tool sets in this scenario.

D: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Tool sets while preserving availability of the critical business service.

Learning point: Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks. Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end.

Question 24

A control owner at Proseware Labs proposes a quick technical fix for Programming languages in the remote access service. The incident response manager must address the control objective without replacing governance with a technology-only shortcut. What should happen FIRST? The delivery organization releases changes through 2 application or service pipelines.

1. Rely on a manual checklist performed during emergencies instead of establishing a repeatable preventive or detective control.
2. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
3. Embed security requirements, threat analysis, testing, approval, and change control throughout the chosen SDLC methodology and into maintenance.
4. Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks.

Correct answer: D

Why: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Programming languages without replacing governance with a technology-only shortcut.

Option review:

A: Manual emergency workarounds are fragile and do not provide the consistent assurance required by the scenario. That action can be useful in a different security decision, but it does not most directly address Programming languages in this scenario.

B: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. That action can be useful in a different security decision, but it does not most directly address Programming languages in this scenario.

C: Security is most effective when it is integrated into delivery rather than added as a final gate. That action can be useful in a different security decision, but it does not most directly address Programming languages in this scenario.

D: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Programming languages without replacing governance with a technology-only shortcut.

Learning point: Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks. Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end.

Question 25

Southridge Media is standardizing security across several business units. The customer identity platform raises a question about Libraries. The security governance lead needs to address the control objective while keeping the process defensible to auditors and business owners. Which action provides the BEST governance and security outcome? The delivery organization releases changes through 3 application or service pipelines.

1. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
2. Deploy a new security product immediately before confirming scope, ownership, or the required security outcome.
3. Use software composition analysis and dependency governance to identify vulnerable or prohibited third-party components.
4. Embed security requirements, threat analysis, testing, approval, and change control throughout the chosen SDLC methodology and into maintenance.

Correct answer: C

Why: SCA focuses on third-party and open-source dependency risk. It directly addresses Libraries while keeping the process defensible to auditors and business owners.

Option review:

A: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. That action can be useful in a different security decision, but it does not most directly address Libraries in this scenario.

B: A product-first response can add complexity without proving that the actual governance, risk, or control requirement is satisfied. That action can be useful in a different security decision, but it does not most directly address Libraries in this scenario.

C: SCA focuses on third-party and open-source dependency risk. It directly addresses Libraries while keeping the process defensible to auditors and business owners.

D: Security is most effective when it is integrated into delivery rather than added as a final gate. That action can be useful in a different security decision, but it does not most directly address Libraries in this scenario.

Learning point: Use software composition analysis and dependency governance to identify vulnerable or prohibited third-party components. SCA focuses on third-party and open-source dependency risk.

Question 26

During a internal audit response, Adventure Works asks the IAM architect to address Tool sets for its data analytics lake. The requirement is to address the control objective while minimizing irreversible action until facts and authority are established. What should the organization do FIRST? The delivery organization releases changes through 4 application or service pipelines.

1. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.
2. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
3. Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks.
4. Grant a small operations group broad administrator access so they can work around the issue whenever it appears.

Correct answer: C

Why: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Tool sets while minimizing irreversible action until facts and authority are established.

Option review:

A: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. That action can be useful in a different security decision, but it does not most directly address Tool sets in this scenario.

B: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. That action can be useful in a different security decision, but it does not most directly address Tool sets in this scenario.

C: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Tool sets while minimizing irreversible action until facts and authority are established.

D: Broad standing privilege conflicts with least privilege and treats symptoms rather than fixing the underlying control design. That action can be useful in a different security decision, but it does not most directly address Tool sets in this scenario.

Learning point: Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks. Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end.

Question 27

VanArsdel Energy is revising controls for its branch-office network. A review highlights Integrated Development Environment (IDE). The application security architect must address the control objective while preserving evidence needed for later review. Which action is the BEST next step? The delivery organization releases changes through 5 application or service pipelines.

1. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
2. Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks.
3. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.
4. Document the risk as accepted without identifying an accountable risk owner or evaluating residual impact.

Correct answer: B

Why: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Integrated Development Environment (IDE) while preserving evidence needed for later review.

Option review:

A: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. That action can be useful in a different security decision, but it does not most directly address Integrated Development Environment (IDE) in this scenario.

B: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. It directly addresses Integrated Development Environment (IDE) while preserving evidence needed for later review.

C: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. That action can be useful in a different security decision, but it does not most directly address Integrated Development Environment (IDE) in this scenario.

D: Risk acceptance is a business decision that requires informed ownership and cannot substitute for analysis. That action can be useful in a different security decision, but it does not most directly address Integrated Development Environment (IDE) in this scenario.

Learning point: Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks. Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end.