Study. uk . com
  1. Home
  2. All questions
  3. Question 79

CISSP study material · question 79 of 500

At a software vendor, one maintainer can merge a change and deploy it to production without another reviewer, and every environment rebuilds the application from source before deployment. A poisoned upstream dependency recently reached the entire customer fleet within an hour. Which two changes align with OWASP's 2025 supply chain guidance? Choose two.

  1. Rebuild the artifact in every environment so each build matches that environment's own configuration.
  2. Publish each vendor update to the whole customer fleet at once so no version drift can accumulate.
  3. Promote one signed build artifact unchanged through each environment on its way to production.
  4. Require review by a second person before any change is allowed to reach the production environment.
Show the answer

Answer: D. Require review by a second person before any change is allowed to reach the production environment.
C. Promote one signed build artifact unchanged through each environment on its way to production.

Second-person review stops one compromised account shipping code, and promoting a single artifact keeps what ran identical to what was reviewed. Rebuilding per environment reopens the substitution gap.

Source: OWASP Top 10 A03:2025 (OWASP) — A03:2025 Software Supply Chain Failures > How to prevent

Challenge yourself on this topic → Study as cards