Which of the following scenarios poses the GREATEST security concern during the system development life cycle (SDLC)?

Question

Options

• ARolling out internet-facing servers to the production environment with vendor default settings
• BEngaging a third-party vendor for code development and testing in the cloud environment
• CUsing ar open source library to support certain web application functionalities
• DRemediating critical and high-risk findings after web application scanning

• A
  60% (15)
• B
  4% (1)
• C
  12% (3)
• D
  24% (6)

Explanation

Deploying internet-facing servers with vendor default settings is the greatest concern because default credentials and configurations are publicly known, widely documented, and actively exploited - making systems immediately vulnerable the moment they go live. Option B (third-party cloud development) introduces supply chain and data exposure risks, but these are manageable through contracts, code reviews, and access controls. Option C (open source libraries) carries dependency and licensing risks, but vetting and monitoring tools (e.g., SCA scanners) mitigate this effectively. Option D (remediating findings post-scan) is actually good security practice, not a concern - it represents the SDLC working as intended.

Memory tip: Think "default = defeated." Vendors ship one-size-fits-all configs optimized for ease of setup, not security - leaving them unchanged on a public-facing server is essentially publishing your front door key online.

No community discussion yet for this question.