MENU
During a manual source code review, an organization discovered a dependency with an open-source library that has a history of being exploited. Which action should the organization take FIRST to assess the risk of depending on the open-source library?
Suggested Answer: A
Get Premium CPIM-8.0 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
26 comments · newest first
DE
Deangelo
1 month ago
True, but we need to know what we're dealing with first. A is crucial!
LO
Louvenia
1 month ago
But what about C? Updating to the latest version could fix issues.
AN
Annice
2 months ago
Agreed! If we know the version, we can check for known exploits.
CY
Cyndy
2 months ago
I think A is the best choice. Knowing the version helps assess vulnerabilities.
CL
Clorinda
2 months ago
C could work, but we need to confirm the current version first.
MY
Myong
2 months ago
B seems risky. We should know what we're dealing with first.
MA
Mari
2 months ago
Agreed, A helps assess the specific vulnerabilities.
AL
Alex
2 months ago
I think A is the best choice. Knowing the version is crucial.
TA
Tayna
3 months ago
I feel like option D is too drastic. We should assess before removing anything.
JO
Joaquin
3 months ago
Option C sounds tempting, but we need to know what we're dealing with first.
AV
Avery
3 months ago
Agreed! Without the version, we can't determine if it's safe or not.
LA
Lawrence
3 months ago
I think option A is the best first step. Knowing the version helps assess vulnerabilities.
WY
Wynell
3 months ago
Really? I thought we should just test it first. B) sounds like a good idea too.
TA
Tatum
4 months ago
C) is risky, you could introduce new vulnerabilities!
WA
Walker
5 months ago
Wait, why not just remove it right away? D) seems safer.
MI
Mitsue
5 months ago
Totally agree, can't assess risk without knowing the version!
KR
Kristofer
5 months ago
A) is the best first step, gotta know what version you're dealing with.
KI
Kindra
6 months ago
Removing dependencies might be too drastic without assessing first.
SH
Shalon
6 months ago
Updating to the latest version is usually a good move.
GI
Gilberto
6 months ago
Surprised they even used that library in the first place!
ST
Stefanie
6 months ago
I think a penetration test is overkill at this stage.
AR
Ardella
6 months ago
Gotta check the specific version first!
LA
Lashon
6 months ago
I wonder if deploying the latest version is really the best first step. I think we need to understand the risks of the current version before doing anything drastic.
TH
Thad
7 months ago
I practiced a similar question, and I feel like jumping straight to a penetration test might be premature. We should know what version we're dealing with first.
VE
Vesta
7 months ago
I'm not entirely sure, but I remember something about needing to assess the current version before making any changes. It seems like option A makes sense.
AL
Alisha
7 months ago
I think the first step should be to identify the specific version of the open-source library. That way, we can see if it has known vulnerabilities.