CAS-005 · Question #12
A company's security team is notified about vulnerabilities in the company's application. The security team determined these vulnerabilities were previously disclosed in third-party libraries. Which…
The correct answer is D. Integrating a SASI tool as part of the pipeline. Software Composition Analysis (SCA) tools scan for known vulnerabilities in third-party libraries and dependencies. Integrating an SCA tool into the development pipeline enables automatic identification of such vulnerabilities early in the development lifecycle.
Question
A company's security team is notified about vulnerabilities in the company's application. The security team determined these vulnerabilities were previously disclosed in third-party libraries. Which of the following solutions best allows the company to identify third-party vulnerabilities in the future?
Options
- AUsing laC to include the newest dependencies
- BCreating a bug bounty program
- CImplementing a continuous security assessment program
- DIntegrating a SASI tool as part of the pipeline
How the community answered
(33 responses)- A3% (1)
- B9% (3)
- C3% (1)
- D85% (28)
Explanation
Software Composition Analysis (SCA) tools scan for known vulnerabilities in third-party libraries and dependencies. Integrating an SCA tool into the development pipeline enables automatic identification of such vulnerabilities early in the development lifecycle.
Community Discussion
No community discussion yet for this question.