Study. uk . com
  1. Home
  2. All questions
  3. Question 491

CISSP study material · question 491 of 500

An organisation with a high risk profile pulls its dependencies directly from public package registries. What does OWASP recommend instead?

  1. Restrict developers to dependencies with more than a threshold number of downloads.
  2. Pin every dependency to a specific version and audit the lock file quarterly.
  3. Host an internal known-good repository that has been vetted.
  4. Mirror the public registry without vetting, to guard against upstream outages.
Show the answer

Answer: C. Host an internal known-good repository that has been vetted.

OWASP says to ensure libraries and dependencies consume only trusted repositories, and that organisations with a higher risk profile should consider hosting an internal known-good repository that is vetted.

Source: OWASP Top 10 A08:2025 (OWASP) — OWASP Top 10:2025 A08 Software or Data Integrity Failures > How to prevent

Challenge yourself on this topic → Study as cards