nerdexam
CompTIA

CAS-002 · Question #570

Which of the following is a security concern with deploying COTS products within the network?

The correct answer is C. It is difficult to verify the security of COTS code because the source is not available to the. COTS (Commercial Off-The-Shelf) software is delivered as compiled binaries without providing source code to customers, making independent security auditing impossible.

Enterprise Security

Question

Which of the following is a security concern with deploying COTS products within the network?

Options

  • AIt is difficult to verify the security of COTS code because the source is available to the
  • BCOTS software often provides the source code as part of the licensing agreement and it
  • CIt is difficult to verify the security of COTS code because the source is not available to the
  • DCOTS source code is readily available to the customer in many cases which opens the

How the community answered

(41 responses)
  • B
    2% (1)
  • C
    93% (38)
  • D
    5% (2)

Why each option

COTS (Commercial Off-The-Shelf) software is delivered as compiled binaries without providing source code to customers, making independent security auditing impossible.

AIt is difficult to verify the security of COTS code because the source is available to the

This contradicts the definition of COTS - the source code is not available to the customer, which is the actual concern.

BCOTS software often provides the source code as part of the licensing agreement and it

COTS licensing agreements do not typically include source code; source access is a characteristic of open-source software, not commercial off-the-shelf products.

CIt is difficult to verify the security of COTS code because the source is not available to theCorrect

COTS products are proprietary, meaning the vendor retains the source code and customers receive only compiled executables. Without access to the source, security teams cannot audit for vulnerabilities, hidden backdoors, or insecure coding practices. This lack of transparency means organizations must implicitly trust the vendor's security posture, inheriting any undiscovered flaws in the product.

DCOTS source code is readily available to the customer in many cases which opens the

COTS source code is generally not available to customers; stating it is 'readily available' misrepresents the closed-source nature of commercial software.

Concept tested: COTS software security risks and closed-source auditing

Source: https://csrc.nist.gov/glossary/term/commercial_off_the_shelf

Topics

#COTS security#third-party software risk#source code availability#vendor software

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice