nerdexam
CompTIA

CAS-002 · Question #147

An organization has had component integration related vulnerabilities exploited in consecutive releases of the software it hosts. The only reason the company was able to identify the compromises was…

The correct answer is D. Establish cross-functional planning and testing requirements for software development. Repeated component integration vulnerabilities caused by fragmented ownership across multiple programming teams indicate that siloed development processes are the root cause. Establishing cross-functional planning and testing requirements directly addresses integration gaps…

Integration of Computing, Communications and Business Disciplines

Question

An organization has had component integration related vulnerabilities exploited in consecutive releases of the software it hosts. The only reason the company was able to identify the compromises was because of a correlation of slow server performance and an attentive security analyst noticing unusual outbound network activity from the application servers. End-to-end management of the development process is the responsibility of the applications development manager and testing is done by various teams of programmers. Which of the following will MOST likely reduce the likelihood of similar incidents?

Options

  • AConduct monthly audits to verify that application modifications do not introduce new
  • BImplement a peer code review requirement prior to releasing code into production.
  • CFollow secure coding practices to minimize the likelihood of creating vulnerable applications.
  • DEstablish cross-functional planning and testing requirements for software development

How the community answered

(51 responses)
  • A
    18% (9)
  • B
    6% (3)
  • C
    10% (5)
  • D
    67% (34)

Why each option

Repeated component integration vulnerabilities caused by fragmented ownership across multiple programming teams indicate that siloed development processes are the root cause. Establishing cross-functional planning and testing requirements directly addresses integration gaps that peer reviews and coding standards alone cannot catch.

AConduct monthly audits to verify that application modifications do not introduce new

Monthly audits are periodic and reactive; by the time an audit catches a new vulnerability introduced in a release, it may already be in production and exploited.

BImplement a peer code review requirement prior to releasing code into production.

Peer code review within individual teams improves single-component quality but does not address the integration boundaries between different teams' components.

CFollow secure coding practices to minimize the likelihood of creating vulnerable applications.

Secure coding practices reduce the introduction of vulnerabilities within individual code units but do not address mismatches and trust assumptions at component integration boundaries.

DEstablish cross-functional planning and testing requirements for software developmentCorrect

Cross-functional teams bring together developers, testers, and security personnel who own different components, ensuring integration points are explicitly reviewed and tested before release. Because the vulnerabilities stem from how components interact - not just individual component quality - only a coordinated, cross-functional process with shared testing requirements will catch integration-level flaws systematically.

Concept tested: Cross-functional SDLC governance for component integration security

Source: https://csrc.nist.gov/projects/ssdf

Topics

#SDLC#component integration#cross-functional testing#code review

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice