SY0-701 Question 296
Single answerA software company is preparing to release a new customer portal built with several open-source libraries. During a recent incident review, leadership discovered that a vulnerable third-party package had been introduced into another internal application and was not detected until after deployment. The security team wants to identify similar issues earlier in the development lifecycle and also be alerted if a package later becomes associated with a newly disclosed CVE. Which approach would BEST meet these requirements?
- A
Perform dynamic application security testing (DAST) against the staging environment before each release
- B
Implement package monitoring for dependencies used by the application
- C
Rely on an annual penetration test conducted by an external consultant
- D
Use a threat feed from a dark web monitoring service to identify compromised packages
Show answer and explanation
Correct answer: B
Explanation
The best answer is to implement package monitoring for dependencies used by the application. In Security+ terms, this falls under application security identification methods and is especially relevant for modern development environments that rely heavily on open-source components. Package monitoring helps organizations identify vulnerable libraries, track dependency health, and receive alerts when newly disclosed vulnerabilities affect software already in use. This aligns with widely accepted secure development practices, including software composition analysis concepts and supply chain risk management. DAST and penetration testing are both useful identification methods, but they are not designed to continuously track dependency exposure over time. Threat feeds, including dark web sources, can complement security monitoring but are not the primary control for identifying vulnerable packages. Best practices from secure software development guidance, such as OWASP recommendations and NIST secure software development principles, support integrating dependency and vulnerability monitoring into the development lifecycle.
- A. Incorrect.
Dynamic application security testing (DAST) evaluates a running application by testing it from the outside, which is useful for identifying issues such as input validation flaws, authentication weaknesses, and some runtime security problems. However, DAST is not the best choice for tracking vulnerable third-party libraries throughout development or for ongoing notification when a dependency is later linked to a newly published CVE. Someone might choose this because DAST is valuable before release, but it does not directly provide dependency-level package monitoring.
- B. Correct.
Package monitoring is the best answer because it is specifically designed to track software dependencies and identify vulnerable, outdated, or risky third-party components. In a modern software supply chain, package monitoring can alert teams when a library included in the application is later associated with a disclosed vulnerability, helping organizations remediate before or shortly after exposure. This directly addresses both requirements: identifying risky packages earlier and receiving updates when new CVEs affect existing dependencies.
- C. Incorrect.
An annual penetration test can uncover exploitable weaknesses in a deployed or staged environment, but it is periodic, point-in-time testing and is not intended to continuously monitor dependency risk. It may miss vulnerable packages that are present but not easily exploitable during the engagement, and it will not automatically notify the organization when a package becomes vulnerable after the test. This is a plausible distractor because penetration testing is a common security assessment method, but it is not the best fit for software dependency tracking.
- D. Incorrect.
A dark web monitoring threat feed may provide intelligence about leaked credentials, criminal discussions, or indicators of compromise, but it is not the primary mechanism for identifying vulnerable software packages in an application's dependency chain. While threat feeds can support broader security operations, they do not replace software composition or package monitoring capabilities tied to dependency and CVE data. Someone might pick this option because threat intelligence sounds proactive, but it does not directly solve the stated software supply chain problem.