Which Tool Identifies Third-Party Library Vulnerabilities?
A company's security team is notified about vulnerabilities in the company's application. The security team determined these vulnerabilities were previously disclosed in third-party libraries. Which of the following solutions best allows the company to identify third-party vulnerabilities in the future?
Community Insight
The question tests whether you can select a control that continuously discovers known CVEs inside external libraries, and the trap is choosing a broader or manual process (bug bounty, continuous assessment) instead of the automated dependency-scanning tool wired into the build.
When vulnerabilities are traced back to previously disclosed flaws in third-party libraries, the strongest preventive solution is integrating a Software Composition Analysis (SCA) tool into the CI/CD pipeline. The page establishes that automated, continuous scanning of open-source and commercial dependencies is what allows the company to catch such third-party vulnerabilities before release.
Option C, a continuous security assessment program, is the most tempting wrong pick because it sounds proactive, but it is an organizational process rather than a technical mechanism that inventories and flags disclosed third-party library CVEs automatically in every build.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
An SCA tool is purpose-built to parse manifests, lockfiles, and binaries to build a software bill of materials of every open-source and third-party component, then match each version against vulnerability databases such as NVD. Integrating it as a pipeline stage means the scan runs on every commit and pull request, failing the build when a dependency carries a known disclosed CVE. Because the reported vulnerabilities were already disclosed in third-party libraries, this automated matching is exactly the detection capability the scenario requires. It also shifts detection left, so the flaw is caught before it ever reaches production.Why the Other Options Are Wrong
Option A, using IaC to include the newest dependencies, addresses infrastructure provisioning and may leave versions fresher, but IaC scanning does not identify vulnerabilities disclosed inside the application's own third-party libraries. Option B, a bug bounty program, relies on external researchers to find flaws after software ships and offers no guaranteed or timely coverage of already-published library CVEs. Option C, a continuous security assessment program, is a worthwhile governance activity but is a process umbrella, not the specific tooling that inventories dependencies and correlates them to disclosed vulnerability records.Community Comment Notes
The lone comment, from jamestkd, independently argues for D, noting that SCA tools "are specifically designed to scan an application's codebase, open-source components, and third-party libraries" and that placing the scan in the CI/CD pipeline yields "automated and proactive detection of third-party vulnerabilities before code reaches production." That reasoning matches the official stance on composition analysis and offset the absence of any contradicting community vote.Exam Strategy
Read for the keyword that names the asset: here it is third-party libraries, which points directly to composition analysis rather than to penetration testing, bounties, or infrastructure tools. When a process answer and a tooling answer both sound reasonable, prefer the option that automates detection inside the delivery pipeline for CAS-005.
Frequently Asked Questions
Why isn't a continuous security assessment program the right choice?
It is a process framework, not a mechanism that inventories dependencies and matches them to disclosed CVEs. An SCA tool performs that detection automatically on every build.
How is an SCA tool different from IaC dependency updates?
IaC provisions and versions infrastructure resources; it does not analyze application libraries. SCA scans manifests and binaries to flag known vulnerable third-party components.
Related Analysis
Practice All CAS-005 Questions
Access 135 questions with complete answers and detailed explanations.
View Full CAS-005 Practice Test →