Continuous Testing Tools DSE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which issue is an SCA tool most likely to detect?

   • AA misconfiguration in the web server
   • BA known vulnerability in an open-source library used by the application
   • CA buffer overflow in the application's own code
   • DAn authentication flaw in the login form
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company uses multiple CI/CD systems: Jenkins for one product line and GitLab CI for another. They want to integrate SCA scanning consistently across both pipelines and ensure that results are visible to developers in their respective tools. Which approach is most maintainable?

   • AExport SCA results to a shared spreadsheet and email them to developers.
   • BRun SCA only in Jenkins and have GitLab CI users manually check results in Jenkins.
   • CUse a centralized SCA service with APIs and plugins for both Jenkins and GitLab CI, and publish results to each system's merge request or build page.
   • DRun a separate SCA tool in each CI system and manage policies independently.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A team wants to ensure that every code change meets a minimum level of testing before it can be merged. They have unit tests, integration tests, and a SAST scan. Which practice enforces this requirement in the CI pipeline?

   • ARun tests only on the main branch after merge and notify the team of any failures.
   • BRequire a senior developer to manually approve every merge after reviewing the test results.
   • CConfigure a quality gate that fails the build if test coverage drops below 80% or any high-severity SAST finding is present.
   • DRun all tests and scans but only report results in a dashboard for the team to review manually.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A team wants to catch common security issues like hardcoded credentials and SQL injection in their Python code before the code is even committed to the repository. They want the check to run on the developer's local machine as well as in CI. Which tool should they use?

   • AA SAST tool that can be run as a pre-commit hook and also as a CI job.
   • BAn IAST tool that instruments the application during runtime.
   • CAn SCA tool that scans the Python package dependencies.
   • DA DAST tool that scans the deployed application.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A team uses GitLab CI/CD and wants to integrate multiple security testing tools (SAST, DAST, and SCA) into their pipeline. They want the results to be aggregated into a single report and to automatically create issues in the GitLab project for each vulnerability. What is the best way to achieve this?

   • ARun each scanner separately and manually copy the results into a shared spreadsheet.
   • BUse a third-party tool that only outputs JSON reports and store them in an S3 bucket.
   • CUse GitLab's built-in security scanners and the security report feature, which aggregates results and can create issues automatically.
   • DConfigure the pipeline to fail on the first scanner that finds a vulnerability, without running the other scanners.
   Reveal Solution Discussion Select an answer first