SY0-701 Question 297
Single answerA software company is preparing to release a new customer portal within two weeks. During final testing, the security team learns that a recently disclosed remote code execution vulnerability affects a third-party logging library used by the application. The development team needs a method to quickly identify whether the vulnerable component is included in the build pipeline and in deployed application packages, without waiting for a full penetration test. Which identification method would BEST meet this need?
- A
Dynamic analysis of the running application in a staging environment
- B
Package monitoring of application dependencies and deployed components
- C
A dark web threat feed to identify whether the company has already been targeted
- D
A system/process audit of change management and release procedures
Show answer and explanation
Correct answer: B
Explanation
The best choice is package monitoring because the scenario is centered on identifying whether a known vulnerable third-party component is present in the software supply chain. Security+ expects candidates to distinguish among identification methods: static analysis reviews source code without executing it, dynamic analysis evaluates a running application, vulnerability scans identify known weaknesses in systems and services, and package monitoring focuses on dependencies and included components. For modern application security, package monitoring aligns with software composition analysis practices used to detect vulnerable libraries in build artifacts and deployed software. This is especially important when responding to newly disclosed CVEs affecting open-source or third-party packages. Best practices from organizations such as NIST and OWASP emphasize maintaining software inventories, monitoring dependencies, and rapidly assessing exposure to vulnerable components as part of secure development and vulnerability management.
- A. Incorrect.
Dynamic analysis tests an application while it is running and can help identify certain runtime issues, such as input validation flaws or insecure behavior during execution. However, it is not the best method for quickly identifying whether a specific vulnerable third-party library is present across the build pipeline and deployed packages. A team might choose this because it sounds like a fast application test, but it does not directly provide software composition visibility.
- B. Correct.
Package monitoring is the best answer because it focuses on identifying application dependencies, libraries, and components included in builds and deployments. In this scenario, the organization needs to determine whether a known vulnerable third-party logging library is present in application packages. Package monitoring, often supported by software composition analysis and dependency tracking, is specifically suited for this use case.
- C. Incorrect.
A dark web threat feed may provide intelligence about criminal discussions, leaked data, or active exploitation trends, but it does not directly identify whether the vulnerable library exists in the company's codebase or deployed packages. Someone might select this option because the vulnerability is newly disclosed and threat intelligence sounds relevant, but threat feeds are not the primary method for inventorying application components.
- D. Incorrect.
A system/process audit reviews whether procedures such as change management, release approvals, and documentation are being followed. While useful for governance and compliance, it does not directly identify the presence of a vulnerable dependency in code repositories or deployment artifacts. This option is plausible because the issue involves the release process, but it does not solve the immediate technical identification requirement.