Discuss CSA CCSK Exam Topic 6 Question 103

How can the use of third-party libraries introduce supply chain risks in software development?

AThey are usually open source and do not require vetting

BThey might contain vulnerabilities that can be exploited

CThey fail to integrate properly with existing continuous integration pipelines

DThey might increase the overall complexity of the codebase

Suggested Answer: B

The use of third-party libraries in software development can introduce supply chain risks because these libraries might contain vulnerabilities that can be exploited. Since third-party libraries often come from external sources, they might not be thoroughly vetted or maintained with the same level of scrutiny as in-house code. Vulnerabilities in these libraries can lead to security breaches, data leaks, or other forms of exploitation if not properly managed and updated.

Although many third-party libraries are open-source, they still require proper vetting for security and compatibility. Integration issues, while a concern, are not directly related to the supply chain risks posed by vulnerabilities. While increased complexity is a challenge, it does not directly relate to security risks or supply chain concerns.

Get Premium CCSK Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

17 comments · newest first

Jovita 22 days ago

Yes, we need to ensure our dependencies are safe.

Zona 28 days ago

I feel like B should be a priority in our assessments.

Markus 1 month ago

Exactly! It's all about balancing convenience and security.

Chan 1 month ago

True, but if we don't vet libraries, we might miss hidden issues.

Jovita 1 month ago

D complicates things, but we can manage complexity.

Zona 2 months ago

C can be a problem, but not as critical as B.

Markus 2 months ago

Agreed! A lot of libraries are open source, so A is risky too.

Chan 2 months ago

I think B is the most concerning. Vulnerabilities can lead to major breaches.

Jacklyn 2 months ago

I’m not sure about C, I think they can integrate just fine if done right.

Florinda 2 months ago

Wait, can third-party libraries really mess up CI pipelines?

Audrie 2 months ago

Totally agree with D, more libraries = more headaches.

Wilbert 3 months ago

A is a bit misleading, not all open source is bad.

Devora 3 months ago

B is spot on! Vulnerabilities are a huge risk.

Lashanda 3 months ago

Complexity definitely seems like a valid concern, but I wonder if it's as significant as the potential vulnerabilities in option B.

Beatriz 3 months ago

I feel like I've seen a practice question about integration issues with CI pipelines before, but I'm not sure if that's the main risk here.

Kent 3 months ago

I think option A might be misleading; not all open-source libraries are unvetted, but they can still pose risks.

Phil 4 months ago

I remember discussing how third-party libraries can introduce vulnerabilities, especially if they aren't regularly updated.

CSA CCSK Exam - Topic 6 Question 103 Discussion