Exam CAS-004 topic 1 question 312 discussion

D. Implement an ongoing, third-party software and library review and regression testing. This is the most comprehensive and effective approach. By continuously reviewing and testing third-party libraries, you ensure that vulnerabilities are identified as they emerge and that patches are applied promptly. Regression testing helps ensure that security updates do not break existing functionality. This ongoing process allows the company to stay ahead of new threats. In short, while all the options have their merits, D is the most critical because it focuses on an ongoing strategy for managing security risks associated with third-party libraries.

D. Implement an ongoing, third-party software and library review and regression testing. This option emphasizes continuous monitoring, review, and testing of the OpenSSL library to identify and address vulnerabilities as they emerge over time. Regular regression testing helps ensure that changes in the software or third-party libraries, such as OpenSSL, do not introduce new vulnerabilities.

Read the question: it says "maximize risk reduction from vulnerabilities introduced by OpenSSL" - the first thing that comes to mind when thinking about OpenSSL is the Heartbleed vulnerability, so using TLS and strong ciphers makes more sense. Third-party software library review and regression testing are not directly linked to OpenSSL vulnerabilities. B is the correct answer.

D. Implement an ongoing, third-party software and library review and regression testing. While all of the options could contribute to risk reduction when using OpenSSL, option D is the most comprehensive and directly addresses the need to maximize risk reduction from vulnerabilities introduced by OpenSSL.