CAS-001 · Question #138
An organization has had component integration related vulnerabilities exploited in consecutive releases of the software it hosts. The only reason the company was able to identify the compromises was…
The correct answer is D. Establish cross-functional planning and testing requirements for software development activities. Establishing cross-functional planning and testing requirements addresses the root cause: fragmented responsibility. The problem states that end-to-end management belongs to the development manager but testing is siloed among separate programmer teams, with no integrated…
Question
An organization has had component integration related vulnerabilities exploited in consecutive releases of the software it hosts. The only reason the company was able to identify the compromises was because of a correlation of slow server performance and an attentive security analyst noticing unusual outbound network activity from the application servers. End-to-end management of the development process is the responsibility of the applications development manager and testing is done by various teams of programmers. Which of the following will MOST likely reduce the likelihood of similar incidents?
Options
- AConduct monthly audits to verify that application modifications do not introduce new vulnerabilities.
- BImplement a peer code review requirement prior to releasing code into production.
- CFollow secure coding practices to minimize the likelihood of creating vulnerable applications.
- DEstablish cross-functional planning and testing requirements for software development activities.
How the community answered
(57 responses)- A30% (17)
- B14% (8)
- C7% (4)
- D49% (28)
Explanation
Establishing cross-functional planning and testing requirements addresses the root cause: fragmented responsibility. The problem states that end-to-end management belongs to the development manager but testing is siloed among separate programmer teams, with no integrated security testing across the development lifecycle. Cross-functional requirements bring security, development, and testing together during planning and testing phases, ensuring component integration points receive dedicated scrutiny before release. Option A (monthly audits) is reactive and infrequent. Option B (peer code review) is a good practice but focuses on individual code, not integration-level issues. Option C (secure coding practices) addresses individual coding behaviors but not the coordination gap between components and teams that is the identified root cause.
Topics
Community Discussion
No community discussion yet for this question.