CS0-004: CompTIA Cybersecurity Analyst (CySA+)Demo

By CompTIA · Question Mode

QuestionQ44

Vulnerability Management

Prior to a merger, the acquiring company's legal team requires a detailed scan of the software codebase to determine whether all code is using open-source libraries or paid licensed libraries. The vulnerability management analyst must provide this report. Which of the following scan methods would best fulfill this requirement?

  • A Static application security testing (SAST)
  • B Dynamic application security testing (DAST)
  • C Software composition analysis (SCA)
  • D Runtime application self-protection (RASP)
  • E Credentialed vulnerability scan
Explanation

Software Composition Analysis (SCA) is designed to inventory the third-party and open-source components and libraries embedded in an application's codebase, identifying each component along with its license type (open-source vs. commercial/paid) and any known vulnerabilities in those dependencies. This directly satisfies the legal team's need for a report on library/license usage across the code base, whereas SAST and DAST focus on identifying security flaws in custom code or running applications, RASP provides runtime protection rather than inventory/reporting, and credentialed vulnerability scans assess host/system configurations rather than software component licensing.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!