ISC2 CISSP Software Security Effectiveness Acquired Software And Secure Coding Practice Test

 

8 Software Development Security • 27 original questions

This CISSP practice test focuses on software security effectiveness acquired software and secure coding through original scenario-based questions aligned to the current ISC2 CISSP Certification Exam Outline. Use the full ExamSnap CISSP collection for practice across all eight domains. For broader exam preparation, review the ISC2 CISSP Exam Dumps page.

Instructions: Select the best answer for each question. Review the explanation after answering; each distractor includes a reason it is not the best choice for that scenario.

Question 1

Wide World Importers is revising controls for its payment processing service. A review highlights Managed services and enterprise applications. The business continuity lead must address the control objective while protecting sensitive data throughout the change. Which action is the BEST next step? The delivery organization releases changes through 2 application or service pipelines.

1. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.
2. Embed security requirements, threat analysis, testing, approval, and change control throughout the chosen SDLC methodology and into maintenance.
3. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
4. Grant a small operations group broad administrator access so they can work around the issue whenever it appears.

Correct answer: A

Why: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. It directly addresses Managed services and enterprise applications while protecting sensitive data throughout the change.

Option review:

A: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. It directly addresses Managed services and enterprise applications while protecting sensitive data throughout the change.

B: Security is most effective when it is integrated into delivery rather than added as a final gate. That action can be useful in a different security decision, but it does not most directly address Managed services and enterprise applications in this scenario.

C: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. That action can be useful in a different security decision, but it does not most directly address Managed services and enterprise applications in this scenario.

D: Broad standing privilege conflicts with least privilege and treats symptoms rather than fixing the underlying control design. That action can be useful in a different security decision, but it does not most directly address Managed services and enterprise applications in this scenario.

Learning point: Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use. Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk.

Question 2

An auditor asks Bellows University to demonstrate how it handles Cloud services including SaaS, IaaS, and PaaS in the software delivery pipeline. The privacy and compliance lead must address the control objective while preserving availability of the critical business service. Which response is MOST appropriate? The delivery organization releases changes through 3 application or service pipelines.

1. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.
2. Embed security requirements, threat analysis, testing, approval, and change control throughout the chosen SDLC methodology and into maintenance.
3. Document the risk as accepted without identifying an accountable risk owner or evaluating residual impact.
4. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.

Correct answer: A

Why: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. It directly addresses Cloud services including SaaS, IaaS, and PaaS while preserving availability of the critical business service.

Option review:

A: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. It directly addresses Cloud services including SaaS, IaaS, and PaaS while preserving availability of the critical business service.

B: Security is most effective when it is integrated into delivery rather than added as a final gate. That action can be useful in a different security decision, but it does not most directly address Cloud services including SaaS, IaaS, and PaaS in this scenario.

C: Risk acceptance is a business decision that requires informed ownership and cannot substitute for analysis. That action can be useful in a different security decision, but it does not most directly address Cloud services including SaaS, IaaS, and PaaS in this scenario.

D: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. That action can be useful in a different security decision, but it does not most directly address Cloud services including SaaS, IaaS, and PaaS in this scenario.

Learning point: Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use. Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk.

Question 3

After a business change, Litware Services discovers that Source-code weaknesses and vulnerabilities is not handled consistently for the AI-assisted customer service platform. The security architect needs to address the control objective without replacing governance with a technology-only shortcut. Which recommendation BEST addresses the issue? The delivery organization releases changes through 4 application or service pipelines.

1. Rely on a manual checklist performed during emergencies instead of establishing a repeatable preventive or detective control.
2. Embed security requirements, threat analysis, testing, approval, and change control throughout the chosen SDLC methodology and into maintenance.
3. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.
4. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.

Correct answer: D

Why: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. It directly addresses Source-code weaknesses and vulnerabilities without replacing governance with a technology-only shortcut.

Option review:

A: Manual emergency workarounds are fragile and do not provide the consistent assurance required by the scenario. That action can be useful in a different security decision, but it does not most directly address Source-code weaknesses and vulnerabilities in this scenario.

B: Security is most effective when it is integrated into delivery rather than added as a final gate. That action can be useful in a different security decision, but it does not most directly address Source-code weaknesses and vulnerabilities in this scenario.

C: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. That action can be useful in a different security decision, but it does not most directly address Source-code weaknesses and vulnerabilities in this scenario.

D: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. It directly addresses Source-code weaknesses and vulnerabilities without replacing governance with a technology-only shortcut.

Learning point: Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable. Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing.

Question 4

Humongous Insurance is preparing a security decision for the global collaboration platform. The decision involves API security. The security operations manager must address the control objective while keeping the process defensible to auditors and business owners. Which option BEST reflects CISSP-level security practice? The delivery organization releases changes through 5 application or service pipelines.

1. Deploy a new security product immediately before confirming scope, ownership, or the required security outcome.
2. Embed security requirements, threat analysis, testing, approval, and change control throughout the chosen SDLC methodology and into maintenance.
3. Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks.
4. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.

Correct answer: D

Why: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. It directly addresses API security while keeping the process defensible to auditors and business owners.

Option review:

A: A product-first response can add complexity without proving that the actual governance, risk, or control requirement is satisfied. That action can be useful in a different security decision, but it does not most directly address API security in this scenario.

B: Security is most effective when it is integrated into delivery rather than added as a final gate. That action can be useful in a different security decision, but it does not most directly address API security in this scenario.

C: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. That action can be useful in a different security decision, but it does not most directly address API security in this scenario.

D: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. It directly addresses API security while keeping the process defensible to auditors and business owners.

Learning point: Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable. Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing.

Question 5

During a risk workshop for the e-commerce application, the team identifies Secure coding practices as the deciding issue. The business continuity lead is expected to address the control objective while minimizing irreversible action until facts and authority are established. What is the MOST appropriate course of action? The delivery organization releases changes through 6 application or service pipelines.

1. Embed security requirements, threat analysis, testing, approval, and change control throughout the chosen SDLC methodology and into maintenance.
2. Grant a small operations group broad administrator access so they can work around the issue whenever it appears.
3. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
4. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.

Correct answer: C

Why: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. It directly addresses Secure coding practices while minimizing irreversible action until facts and authority are established.

Option review:

A: Security is most effective when it is integrated into delivery rather than added as a final gate. That action can be useful in a different security decision, but it does not most directly address Secure coding practices in this scenario.

B: Broad standing privilege conflicts with least privilege and treats symptoms rather than fixing the underlying control design. That action can be useful in a different security decision, but it does not most directly address Secure coding practices in this scenario.

C: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. It directly addresses Secure coding practices while minimizing irreversible action until facts and authority are established.

D: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. That action can be useful in a different security decision, but it does not most directly address Secure coding practices in this scenario.

Learning point: Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable. Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing.

Question 6

A control owner at Relecloud Systems proposes a quick technical fix for Software-defined security in the clinical records environment. The privacy and compliance lead must address the control objective while preserving evidence needed for later review. What should happen FIRST? The delivery organization releases changes through 7 application or service pipelines.

1. Embed security requirements, threat analysis, testing, approval, and change control throughout the chosen SDLC methodology and into maintenance.
2. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
3. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.
4. Document the risk as accepted without identifying an accountable risk owner or evaluating residual impact.

Correct answer: B

Why: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. It directly addresses Software-defined security while preserving evidence needed for later review.

Option review:

A: Security is most effective when it is integrated into delivery rather than added as a final gate. That action can be useful in a different security decision, but it does not most directly address Software-defined security in this scenario.

B: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. It directly addresses Software-defined security while preserving evidence needed for later review.

C: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. That action can be useful in a different security decision, but it does not most directly address Software-defined security in this scenario.

D: Risk acceptance is a business decision that requires informed ownership and cannot substitute for analysis. That action can be useful in a different security decision, but it does not most directly address Software-defined security in this scenario.

Learning point: Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable. Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing.

Question 7

Contoso Financial is standardizing security across several business units. The remote access service raises a question about Auditing and logging of changes. The security architect needs to address the control objective without granting broader privilege than the business need requires. Which action provides the BEST governance and security outcome? The delivery organization releases changes through 5 application or service pipelines.

1. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
2. Rely on a manual checklist performed during emergencies instead of establishing a repeatable preventive or detective control.
3. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.
4. Embed security requirements, threat analysis, testing, approval, and change control throughout the chosen SDLC methodology and into maintenance.

Correct answer: C

Why: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. It directly addresses Auditing and logging of changes without granting broader privilege than the business need requires.

Option review:

A: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. That action can be useful in a different security decision, but it does not most directly address Auditing and logging of changes in this scenario.

B: Manual emergency workarounds are fragile and do not provide the consistent assurance required by the scenario. That action can be useful in a different security decision, but it does not most directly address Auditing and logging of changes in this scenario.

C: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. It directly addresses Auditing and logging of changes without granting broader privilege than the business need requires.

D: Security is most effective when it is integrated into delivery rather than added as a final gate. That action can be useful in a different security decision, but it does not most directly address Auditing and logging of changes in this scenario.

Learning point: Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk. Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed.

Question 8

During a business continuity exercise, Lucerne Publishing asks the security operations manager to address Risk analysis and mitigation for its customer identity platform. The requirement is to address the control objective without creating a new single point of failure. What should the organization do FIRST? The delivery organization releases changes through 6 application or service pipelines.

1. Deploy a new security product immediately before confirming scope, ownership, or the required security outcome.
2. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.
3. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
4. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.

Correct answer: B

Why: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. It directly addresses Risk analysis and mitigation without creating a new single point of failure.

Option review:

A: A product-first response can add complexity without proving that the actual governance, risk, or control requirement is satisfied. That action can be useful in a different security decision, but it does not most directly address Risk analysis and mitigation in this scenario.

B: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. It directly addresses Risk analysis and mitigation without creating a new single point of failure.

C: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. That action can be useful in a different security decision, but it does not most directly address Risk analysis and mitigation in this scenario.

D: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. That action can be useful in a different security decision, but it does not most directly address Risk analysis and mitigation in this scenario.

Learning point: Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk. Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed.

Question 9

Lamna Healthcare is revising controls for its data analytics lake. A review highlights Commercial-off-the-shelf (COTS). The business continuity lead must address the control objective while ensuring that emergency access cannot become permanent access. Which action is the BEST next step? The delivery organization releases changes through 7 application or service pipelines.

1. Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks.
2. Grant a small operations group broad administrator access so they can work around the issue whenever it appears.
3. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
4. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.

Correct answer: D

Why: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. It directly addresses Commercial-off-the-shelf (COTS) while ensuring that emergency access cannot become permanent access.

Option review:

A: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. That action can be useful in a different security decision, but it does not most directly address Commercial-off-the-shelf (COTS) in this scenario.

B: Broad standing privilege conflicts with least privilege and treats symptoms rather than fixing the underlying control design. That action can be useful in a different security decision, but it does not most directly address Commercial-off-the-shelf (COTS) in this scenario.

C: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. That action can be useful in a different security decision, but it does not most directly address Commercial-off-the-shelf (COTS) in this scenario.

D: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. It directly addresses Commercial-off-the-shelf (COTS) while ensuring that emergency access cannot become permanent access.

Learning point: Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use. Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk.

Question 10

An auditor asks Fourth Coffee to demonstrate how it handles Open-source software in the branch-office network. The privacy and compliance lead must address the control objective while allowing independent verification of the control outcome. Which response is MOST appropriate? The delivery organization releases changes through 8 application or service pipelines.

1. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.
2. Document the risk as accepted without identifying an accountable risk owner or evaluating residual impact.
3. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.
4. Embed security requirements, threat analysis, testing, approval, and change control throughout the chosen SDLC methodology and into maintenance.

Correct answer: C

Why: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. It directly addresses Open-source software while allowing independent verification of the control outcome.

Option review:

A: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. That action can be useful in a different security decision, but it does not most directly address Open-source software in this scenario.

B: Risk acceptance is a business decision that requires informed ownership and cannot substitute for analysis. That action can be useful in a different security decision, but it does not most directly address Open-source software in this scenario.

C: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. It directly addresses Open-source software while allowing independent verification of the control outcome.

D: Security is most effective when it is integrated into delivery rather than added as a final gate. That action can be useful in a different security decision, but it does not most directly address Open-source software in this scenario.

Learning point: Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use. Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk.

Question 11

After a business change, Consolidated Messenger discovers that Third-party software is not handled consistently for the industrial control network. The security architect needs to address the control objective while accounting for third-party and lifecycle dependencies. Which recommendation BEST addresses the issue? The delivery organization releases changes through 9 application or service pipelines.

1. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.
2. Rely on a manual checklist performed during emergencies instead of establishing a repeatable preventive or detective control.
3. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.
4. Embed security requirements, threat analysis, testing, approval, and change control throughout the chosen SDLC methodology and into maintenance.

Correct answer: C

Why: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. It directly addresses Third-party software while accounting for third-party and lifecycle dependencies.

Option review:

A: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. That action can be useful in a different security decision, but it does not most directly address Third-party software in this scenario.

B: Manual emergency workarounds are fragile and do not provide the consistent assurance required by the scenario. That action can be useful in a different security decision, but it does not most directly address Third-party software in this scenario.

C: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. It directly addresses Third-party software while accounting for third-party and lifecycle dependencies.

D: Security is most effective when it is integrated into delivery rather than added as a final gate. That action can be useful in a different security decision, but it does not most directly address Third-party software in this scenario.

Learning point: Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use. Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk.

Question 12

Proseware Labs is preparing a security decision for the research data repository. The decision involves Managed services and enterprise applications. The security operations manager must address the control objective while maintaining the organization’s stated risk appetite. Which option BEST reflects CISSP-level security practice? The delivery organization releases changes through 7 application or service pipelines.

1. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.
2. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
3. Deploy a new security product immediately before confirming scope, ownership, or the required security outcome.
4. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.

Correct answer: D

Why: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. It directly addresses Managed services and enterprise applications while maintaining the organization’s stated risk appetite.

Option review:

A: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. That action can be useful in a different security decision, but it does not most directly address Managed services and enterprise applications in this scenario.

B: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. That action can be useful in a different security decision, but it does not most directly address Managed services and enterprise applications in this scenario.

C: A product-first response can add complexity without proving that the actual governance, risk, or control requirement is satisfied. That action can be useful in a different security decision, but it does not most directly address Managed services and enterprise applications in this scenario.

D: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. It directly addresses Managed services and enterprise applications while maintaining the organization’s stated risk appetite.

Learning point: Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use. Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk.

Question 13

During a risk workshop for the payment processing service, the team identifies Cloud services including SaaS, IaaS, and PaaS as the deciding issue. The business continuity lead is expected to address the control objective while meeting the business objective with the least unnecessary operational complexity. What is the MOST appropriate course of action? The delivery organization releases changes through 8 application or service pipelines.

1. Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks.
2. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
3. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.
4. Grant a small operations group broad administrator access so they can work around the issue whenever it appears.

Correct answer: C

Why: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. It directly addresses Cloud services including SaaS, IaaS, and PaaS while meeting the business objective with the least unnecessary operational complexity.

Option review:

A: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. That action can be useful in a different security decision, but it does not most directly address Cloud services including SaaS, IaaS, and PaaS in this scenario.

B: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. That action can be useful in a different security decision, but it does not most directly address Cloud services including SaaS, IaaS, and PaaS in this scenario.

C: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. It directly addresses Cloud services including SaaS, IaaS, and PaaS while meeting the business objective with the least unnecessary operational complexity.

D: Broad standing privilege conflicts with least privilege and treats symptoms rather than fixing the underlying control design. That action can be useful in a different security decision, but it does not most directly address Cloud services including SaaS, IaaS, and PaaS in this scenario.

Learning point: Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use. Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk.

Question 14

A control owner at Adventure Works proposes a quick technical fix for Source-code weaknesses and vulnerabilities in the software delivery pipeline. The privacy and compliance lead must address the control objective while keeping the control sustainable for normal operations. What should happen FIRST? The delivery organization releases changes through 9 application or service pipelines.

1. Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks.
2. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.
3. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
4. Document the risk as accepted without identifying an accountable risk owner or evaluating residual impact.

Correct answer: C

Why: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. It directly addresses Source-code weaknesses and vulnerabilities while keeping the control sustainable for normal operations.

Option review:

A: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. That action can be useful in a different security decision, but it does not most directly address Source-code weaknesses and vulnerabilities in this scenario.

B: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. That action can be useful in a different security decision, but it does not most directly address Source-code weaknesses and vulnerabilities in this scenario.

C: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. It directly addresses Source-code weaknesses and vulnerabilities while keeping the control sustainable for normal operations.

D: Risk acceptance is a business decision that requires informed ownership and cannot substitute for analysis. That action can be useful in a different security decision, but it does not most directly address Source-code weaknesses and vulnerabilities in this scenario.

Learning point: Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable. Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing.

Question 15

VanArsdel Energy is standardizing security across several business units. The AI-assisted customer service platform raises a question about API security. The security architect needs to address the control objective while ensuring the decision can be repeated consistently across business units. Which action provides the BEST governance and security outcome? The delivery organization releases changes through 2 application or service pipelines.

1. Rely on a manual checklist performed during emergencies instead of establishing a repeatable preventive or detective control.
2. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
3. Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks.
4. Embed security requirements, threat analysis, testing, approval, and change control throughout the chosen SDLC methodology and into maintenance.

Correct answer: B

Why: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. It directly addresses API security while ensuring the decision can be repeated consistently across business units.

Option review:

A: Manual emergency workarounds are fragile and do not provide the consistent assurance required by the scenario. That action can be useful in a different security decision, but it does not most directly address API security in this scenario.

B: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. It directly addresses API security while ensuring the decision can be repeated consistently across business units.

C: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. That action can be useful in a different security decision, but it does not most directly address API security in this scenario.

D: Security is most effective when it is integrated into delivery rather than added as a final gate. That action can be useful in a different security decision, but it does not most directly address API security in this scenario.

Learning point: Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable. Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing.

Question 16

During a post-incident improvement program, Northwind Health asks the security operations manager to address Secure coding practices for its global collaboration platform. The requirement is to address the control objective while preserving clear accountability and audit evidence. What should the organization do FIRST? The delivery organization releases changes through 3 application or service pipelines.

1. Deploy a new security product immediately before confirming scope, ownership, or the required security outcome.
2. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.
3. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
4. Embed security requirements, threat analysis, testing, approval, and change control throughout the chosen SDLC methodology and into maintenance.

Correct answer: C

Why: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. It directly addresses Secure coding practices while preserving clear accountability and audit evidence.

Option review:

A: A product-first response can add complexity without proving that the actual governance, risk, or control requirement is satisfied. That action can be useful in a different security decision, but it does not most directly address Secure coding practices in this scenario.

B: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. That action can be useful in a different security decision, but it does not most directly address Secure coding practices in this scenario.

C: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. It directly addresses Secure coding practices while preserving clear accountability and audit evidence.

D: Security is most effective when it is integrated into delivery rather than added as a final gate. That action can be useful in a different security decision, but it does not most directly address Secure coding practices in this scenario.

Learning point: Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable. Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing.

Question 17

Coho Insurance is revising controls for its e-commerce application. A review highlights Software-defined security. The business continuity lead must address the control objective while protecting sensitive data throughout the change. Which action is the BEST next step? The delivery organization releases changes through 9 application or service pipelines.

1. Embed security requirements, threat analysis, testing, approval, and change control throughout the chosen SDLC methodology and into maintenance.
2. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.
3. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
4. Grant a small operations group broad administrator access so they can work around the issue whenever it appears.

Correct answer: C

Why: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. It directly addresses Software-defined security while protecting sensitive data throughout the change.

Option review:

A: Security is most effective when it is integrated into delivery rather than added as a final gate. That action can be useful in a different security decision, but it does not most directly address Software-defined security in this scenario.

B: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. That action can be useful in a different security decision, but it does not most directly address Software-defined security in this scenario.

C: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. It directly addresses Software-defined security while protecting sensitive data throughout the change.

D: Broad standing privilege conflicts with least privilege and treats symptoms rather than fixing the underlying control design. That action can be useful in a different security decision, but it does not most directly address Software-defined security in this scenario.

Learning point: Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable. Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing.

Question 18

An auditor asks A. Datum Analytics to demonstrate how it handles Auditing and logging of changes in the clinical records environment. The privacy and compliance lead must address the control objective while preserving availability of the critical business service. Which response is MOST appropriate? The delivery organization releases changes through 2 application or service pipelines.

1. Document the risk as accepted without identifying an accountable risk owner or evaluating residual impact.
2. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.
3. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.
4. Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks.

Correct answer: C

Why: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. It directly addresses Auditing and logging of changes while preserving availability of the critical business service.

Option review:

A: Risk acceptance is a business decision that requires informed ownership and cannot substitute for analysis. That action can be useful in a different security decision, but it does not most directly address Auditing and logging of changes in this scenario.

B: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. That action can be useful in a different security decision, but it does not most directly address Auditing and logging of changes in this scenario.

C: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. It directly addresses Auditing and logging of changes while preserving availability of the critical business service.

D: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. That action can be useful in a different security decision, but it does not most directly address Auditing and logging of changes in this scenario.

Learning point: Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk. Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed.

Question 19

After a business change, Blue Yonder Airlines discovers that Risk analysis and mitigation is not handled consistently for the remote access service. The security architect needs to address the control objective without replacing governance with a technology-only shortcut. Which recommendation BEST addresses the issue? The delivery organization releases changes through 3 application or service pipelines.

1. Rely on a manual checklist performed during emergencies instead of establishing a repeatable preventive or detective control.
2. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.
3. Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks.
4. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.

Correct answer: B

Why: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. It directly addresses Risk analysis and mitigation without replacing governance with a technology-only shortcut.

Option review:

A: Manual emergency workarounds are fragile and do not provide the consistent assurance required by the scenario. That action can be useful in a different security decision, but it does not most directly address Risk analysis and mitigation in this scenario.

B: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. It directly addresses Risk analysis and mitigation without replacing governance with a technology-only shortcut.

C: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. That action can be useful in a different security decision, but it does not most directly address Risk analysis and mitigation in this scenario.

D: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. That action can be useful in a different security decision, but it does not most directly address Risk analysis and mitigation in this scenario.

Learning point: Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk. Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed.

Question 20

City Power is preparing a security decision for the customer identity platform. The decision involves Commercial-off-the-shelf (COTS). The security operations manager must address the control objective while keeping the process defensible to auditors and business owners. Which option BEST reflects CISSP-level security practice? The delivery organization releases changes through 4 application or service pipelines.

1. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.
2. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.
3. Embed security requirements, threat analysis, testing, approval, and change control throughout the chosen SDLC methodology and into maintenance.
4. Deploy a new security product immediately before confirming scope, ownership, or the required security outcome.

Correct answer: A

Why: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. It directly addresses Commercial-off-the-shelf (COTS) while keeping the process defensible to auditors and business owners.

Option review:

A: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. It directly addresses Commercial-off-the-shelf (COTS) while keeping the process defensible to auditors and business owners.

B: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. That action can be useful in a different security decision, but it does not most directly address Commercial-off-the-shelf (COTS) in this scenario.

C: Security is most effective when it is integrated into delivery rather than added as a final gate. That action can be useful in a different security decision, but it does not most directly address Commercial-off-the-shelf (COTS) in this scenario.

D: A product-first response can add complexity without proving that the actual governance, risk, or control requirement is satisfied. That action can be useful in a different security decision, but it does not most directly address Commercial-off-the-shelf (COTS) in this scenario.

Learning point: Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use. Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk.

Question 21

During a risk workshop for the data analytics lake, the team identifies Open-source software as the deciding issue. The business continuity lead is expected to address the control objective while minimizing irreversible action until facts and authority are established. What is the MOST appropriate course of action? The delivery organization releases changes through 5 application or service pipelines.

1. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
2. Grant a small operations group broad administrator access so they can work around the issue whenever it appears.
3. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.
4. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.

Correct answer: C

Why: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. It directly addresses Open-source software while minimizing irreversible action until facts and authority are established.

Option review:

A: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. That action can be useful in a different security decision, but it does not most directly address Open-source software in this scenario.

B: Broad standing privilege conflicts with least privilege and treats symptoms rather than fixing the underlying control design. That action can be useful in a different security decision, but it does not most directly address Open-source software in this scenario.

C: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. It directly addresses Open-source software while minimizing irreversible action until facts and authority are established.

D: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. That action can be useful in a different security decision, but it does not most directly address Open-source software in this scenario.

Learning point: Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use. Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk.

Question 22

A control owner at Alpine Sports proposes a quick technical fix for Third-party software in the branch-office network. The privacy and compliance lead must address the control objective while preserving evidence needed for later review. What should happen FIRST? The delivery organization releases changes through 6 application or service pipelines.

1. Document the risk as accepted without identifying an accountable risk owner or evaluating residual impact.
2. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.
3. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
4. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.

Correct answer: D

Why: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. It directly addresses Third-party software while preserving evidence needed for later review.

Option review:

A: Risk acceptance is a business decision that requires informed ownership and cannot substitute for analysis. That action can be useful in a different security decision, but it does not most directly address Third-party software in this scenario.

B: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. That action can be useful in a different security decision, but it does not most directly address Third-party software in this scenario.

C: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. That action can be useful in a different security decision, but it does not most directly address Third-party software in this scenario.

D: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. It directly addresses Third-party software while preserving evidence needed for later review.

Learning point: Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use. Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk.

Question 23

Fabrikam Manufacturing is standardizing security across several business units. The industrial control network raises a question about Auditing and logging of changes. The security architect needs to address the control objective without granting broader privilege than the business need requires. Which action provides the BEST governance and security outcome? The delivery organization releases changes through 4 application or service pipelines.

1. Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks.
2. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.
3. Rely on a manual checklist performed during emergencies instead of establishing a repeatable preventive or detective control.
4. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.

Correct answer: B

Why: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. It directly addresses Auditing and logging of changes without granting broader privilege than the business need requires.

Option review:

A: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. That action can be useful in a different security decision, but it does not most directly address Auditing and logging of changes in this scenario.

B: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. It directly addresses Auditing and logging of changes without granting broader privilege than the business need requires.

C: Manual emergency workarounds are fragile and do not provide the consistent assurance required by the scenario. That action can be useful in a different security decision, but it does not most directly address Auditing and logging of changes in this scenario.

D: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. That action can be useful in a different security decision, but it does not most directly address Auditing and logging of changes in this scenario.

Learning point: Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk. Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed.

Question 24

During a quarterly security review, Trey Research asks the security operations manager to address Risk analysis and mitigation for its research data repository. The requirement is to address the control objective without creating a new single point of failure. What should the organization do FIRST? The delivery organization releases changes through 5 application or service pipelines.

1. Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks.
2. Embed security requirements, threat analysis, testing, approval, and change control throughout the chosen SDLC methodology and into maintenance.
3. Deploy a new security product immediately before confirming scope, ownership, or the required security outcome.
4. Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk.

Correct answer: D

Why: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. It directly addresses Risk analysis and mitigation without creating a new single point of failure.

Option review:

A: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. That action can be useful in a different security decision, but it does not most directly address Risk analysis and mitigation in this scenario.

B: Security is most effective when it is integrated into delivery rather than added as a final gate. That action can be useful in a different security decision, but it does not most directly address Risk analysis and mitigation in this scenario.

C: A product-first response can add complexity without proving that the actual governance, risk, or control requirement is satisfied. That action can be useful in a different security decision, but it does not most directly address Risk analysis and mitigation in this scenario.

D: Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed. It directly addresses Risk analysis and mitigation without creating a new single point of failure.

Learning point: Measure software-security effectiveness through auditable changes, defect trends, risk analysis, and evidence that controls reduce exploitable risk. Security effectiveness should be demonstrated by risk and control outcomes rather than the number of tools deployed.

Question 25

Margie Travel is revising controls for its payment processing service. A review highlights Commercial-off-the-shelf (COTS). The business continuity lead must address the control objective while ensuring that emergency access cannot become permanent access. Which action is the BEST next step? The delivery organization releases changes through 6 application or service pipelines.

1. Grant a small operations group broad administrator access so they can work around the issue whenever it appears.
2. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
3. Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks.
4. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.

Correct answer: D

Why: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. It directly addresses Commercial-off-the-shelf (COTS) while ensuring that emergency access cannot become permanent access.

Option review:

A: Broad standing privilege conflicts with least privilege and treats symptoms rather than fixing the underlying control design. That action can be useful in a different security decision, but it does not most directly address Commercial-off-the-shelf (COTS) in this scenario.

B: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. That action can be useful in a different security decision, but it does not most directly address Commercial-off-the-shelf (COTS) in this scenario.

C: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. That action can be useful in a different security decision, but it does not most directly address Commercial-off-the-shelf (COTS) in this scenario.

D: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. It directly addresses Commercial-off-the-shelf (COTS) while ensuring that emergency access cannot become permanent access.

Learning point: Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use. Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk.

Question 26

An auditor asks Wide World Importers to demonstrate how it handles Open-source software in the software delivery pipeline. The privacy and compliance lead must address the control objective while allowing independent verification of the control outcome. Which response is MOST appropriate? The delivery organization releases changes through 7 application or service pipelines.

1. Secure the development toolchain, repositories, dependencies, CI/CD pipeline, runtime, and testing stack using least privilege, provenance, and automated security checks.
2. Document the risk as accepted without identifying an accountable risk owner or evaluating residual impact.
3. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.
4. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.

Correct answer: C

Why: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. It directly addresses Open-source software while allowing independent verification of the control outcome.

Option review:

A: Software supply-chain and pipeline compromise can bypass otherwise secure source code, so the ecosystem must be protected end to end. That action can be useful in a different security decision, but it does not most directly address Open-source software in this scenario.

B: Risk acceptance is a business decision that requires informed ownership and cannot substitute for analysis. That action can be useful in a different security decision, but it does not most directly address Open-source software in this scenario.

C: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. It directly addresses Open-source software while allowing independent verification of the control outcome.

D: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. That action can be useful in a different security decision, but it does not most directly address Open-source software in this scenario.

Learning point: Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use. Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk.

Question 27

After a business change, Bellows University discovers that Third-party software is not handled consistently for the AI-assisted customer service platform. The security architect needs to address the control objective while accounting for third-party and lifecycle dependencies. Which recommendation BEST addresses the issue? The delivery organization releases changes through 8 application or service pipelines.

1. Apply secure coding standards that prevent source-level weaknesses, protect APIs, validate input, enforce authorization, and make security requirements testable.
2. Rely on a manual checklist performed during emergencies instead of establishing a repeatable preventive or detective control.
3. Embed security requirements, threat analysis, testing, approval, and change control throughout the chosen SDLC methodology and into maintenance.
4. Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use.

Correct answer: D

Why: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. It directly addresses Third-party software while accounting for third-party and lifecycle dependencies.

Option review:

A: Secure coding reduces vulnerabilities at their source and provides concrete expectations for code review and testing. That action can be useful in a different security decision, but it does not most directly address Third-party software in this scenario.

B: Manual emergency workarounds are fragile and do not provide the consistent assurance required by the scenario. That action can be useful in a different security decision, but it does not most directly address Third-party software in this scenario.

C: Security is most effective when it is integrated into delivery rather than added as a final gate. That action can be useful in a different security decision, but it does not most directly address Third-party software in this scenario.

D: Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk. It directly addresses Third-party software while accounting for third-party and lifecycle dependencies.

Learning point: Assess acquired software and services for supplier, dependency, data, vulnerability, support, and contractual security risk before acceptance and throughout use. Buying or outsourcing software transfers implementation work but not the organization’s accountability for security risk.