ISC CISSP Bundle

The other scenario states that a company wants runtime feedback showing which tested lines and components create unsafe calls, where iAST can combine runtime execution context with vulnerability observations; by contrast, the present case requires use software composition analysis and verified dependency remediation.

Unexpected artifact differences can indicate tampering or uncontrolled dependencies; it is relevant where a firmware build succeeds but its binary differs from the approved reproducible build output, whereas the current facts require use software composition analysis and verified dependency remediation to address the stated problem.

This option fits a different fact pattern where a continuous delivery pipeline stores production credentials in unprotected environment variables visible to all jobs: cI workers should not expose persistent production credentials to untrusted build tasks; the current case instead requires use software composition analysis and verified dependency remediation.

The other scenario states that a CI tool executes untrusted pull-request code with production network access, where attacker-controlled pipeline inputs should not inherit deployment privileges; by contrast, the present case requires use static code analysis with appropriate data-flow rules.

Source-control privileges are part of release integrity and should reflect trust boundaries; it is relevant where a repository lets every contributor directly modify signed release tags, whereas the current facts require use static code analysis with appropriate data-flow rules to address the stated problem.

This option fits a different fact pattern where a company wants runtime feedback showing which tested lines and components create unsafe calls: iAST can combine runtime execution context with vulnerability observations; the current case instead requires use static code analysis with appropriate data-flow rules.

Source-control privileges are part of release integrity and should reflect trust boundaries; it is relevant where a repository lets every contributor directly modify signed release tags, whereas the current facts require conduct authorized dynamic application tests against running endpoints to address the stated problem.

Attacker-controlled pipeline inputs should not inherit deployment privileges; although this helps when a CI tool executes untrusted pull-request code with production network access, it leaves the current case's need to conduct authorized dynamic application tests against running endpoints unresolved.

SAST can inspect possible unsafe data paths without needing a live deployment; this responds to the different circumstance in which a security engineer wants to find tainted input reaching dangerous SQL APIs without running the application, while the current case states that a web application may be vulnerable to authentication bypass after deployment, but source isn't available, calling for conduct authorized dynamic application tests against running endpoints.

SCA identifies risks in included packages that first-party static analysis may miss; this responds to the different circumstance in which a Java application imports outdated components with known flaws, while the current case states that a company wants runtime feedback showing which tested lines and components create unsafe calls, calling for use instrumented interactive application security testing where appropriate.

SAST can inspect possible unsafe data paths without needing a live deployment; it is relevant where a security engineer wants to find tainted input reaching dangerous SQL APIs without running the application, whereas the current facts require use instrumented interactive application security testing where appropriate to address the stated problem.

The other scenario states that a development team adopts an unfamiliar container image from a public registry without reviewing contents, where trusted deployment requires validating third-party runtime artifacts, not just their advertised tags; by contrast, the present case requires use instrumented interactive application security testing where appropriate.

This option fits a different fact pattern where a development team adopts an unfamiliar container image from a public registry without reviewing contents: trusted deployment requires validating third-party runtime artifacts, not just their advertised tags; the current case instead requires use scoped secrets management and isolation of privileged deployment stages.

DAST observes deployed behavior from interfaces even without source-code access; it is relevant where a web application may be vulnerable to authentication bypass after deployment, but source isn't available, whereas the current facts require use scoped secrets management and isolation of privileged deployment stages to address the stated problem.

The other scenario states that a Java application imports outdated components with known flaws, where sCA identifies risks in included packages that first-party static analysis may miss; by contrast, the present case requires use scoped secrets management and isolation of privileged deployment stages.

Unexpected artifact differences can indicate tampering or uncontrolled dependencies; this responds to the different circumstance in which a firmware build succeeds but its binary differs from the approved reproducible build output, while the current case states that a repository lets every contributor directly modify signed release tags, calling for protect critical branches and tags with verified review and signing controls.

For the separate situation in which a company wants runtime feedback showing which tested lines and components create unsafe calls, iAST can combine runtime execution context with vulnerability observations; here the stated problem requires protect critical branches and tags with verified review and signing controls.

DAST observes deployed behavior from interfaces even without source-code access; it is relevant where a web application may be vulnerable to authentication bypass after deployment, but source isn't available, whereas the current facts require protect critical branches and tags with verified review and signing controls to address the stated problem.

IAST can combine runtime execution context with vulnerability observations; it is relevant where a company wants runtime feedback showing which tested lines and components create unsafe calls, whereas the current facts require investigate build-chain integrity and block release pending provenance verification to address the stated problem.

For the separate situation in which a repository lets every contributor directly modify signed release tags, source-control privileges are part of release integrity and should reflect trust boundaries; here the stated problem requires investigate build-chain integrity and block release pending provenance verification.

This option fits a different fact pattern where a CI tool executes untrusted pull-request code with production network access: attacker-controlled pipeline inputs should not inherit deployment privileges; the current case instead requires investigate build-chain integrity and block release pending provenance verification.

Unexpected artifact differences can indicate tampering or uncontrolled dependencies; it is relevant where a firmware build succeeds but its binary differs from the approved reproducible build output, whereas the current facts require run untrusted builds in restricted ephemeral environments without sensitive secrets to address the stated problem.

This option fits a different fact pattern where a security engineer wants to find tainted input reaching dangerous SQL APIs without running the application: sAST can inspect possible unsafe data paths without needing a live deployment; the current case instead requires run untrusted builds in restricted ephemeral environments without sensitive secrets.

CI workers should not expose persistent production credentials to untrusted build tasks; this responds to the different circumstance in which a continuous delivery pipeline stores production credentials in unprotected environment variables visible to all jobs, while the current case states that a CI tool executes untrusted pull-request code with production network access, calling for run untrusted builds in restricted ephemeral environments without sensitive secrets.

The other scenario states that a continuous delivery pipeline stores production credentials in unprotected environment variables visible to all jobs, where cI workers should not expose persistent production credentials to untrusted build tasks; by contrast, the present case requires review image provenance, signed digests and component vulnerabilities before promotion.

This option fits a different fact pattern where a repository lets every contributor directly modify signed release tags: source-control privileges are part of release integrity and should reflect trust boundaries; the current case instead requires review image provenance, signed digests and component vulnerabilities before promotion.

Unexpected artifact differences can indicate tampering or uncontrolled dependencies; it is relevant where a firmware build succeeds but its binary differs from the approved reproducible build output, whereas the current facts require review image provenance, signed digests and component vulnerabilities before promotion to address the stated problem.

One tool's results cannot establish absence of design, configuration or logic flaws; although this helps when a SAST tool reports no findings on generated code, so a team declares the product secure, it leaves the current case's need to retest corrected weaknesses with negative and regression tests unresolved.

This option fits a different fact pattern where a red-team exercise reveals an authorization bypass that unit tests never considered: security tests should capture plausible attacker behavior, not only expected application use; the current case instead requires retest corrected weaknesses with negative and regression tests.

This option fits a different fact pattern where a vendor reports strong software security but refuses to provide development-process evidence: claims of product safety need proportionate supporting evidence and scope; the current case instead requires retest corrected weaknesses with negative and regression tests.

Process maturity requires observable execution rather than merely publishing guidance; it is relevant where a secure coding checklist exists but no team can demonstrate its use during review, whereas the current facts require record security-impact review tied to the implemented change and approval to address the stated problem.

One tool's results cannot establish absence of design, configuration or logic flaws; although this helps when a SAST tool reports no findings on generated code, so a team declares the product secure, it leaves the current case's need to record security-impact review tied to the implemented change and approval unresolved.

For the separate situation in which an application has few defects but every new release reintroduces the same category of flaw, recurrence signals a systemic process weakness rather than isolated bugs; here the stated problem requires record security-impact review tied to the implemented change and approval.