Integrating the Code Repo to SAST Tools ECDE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   After integrating a SAST tool with a GitHub repository, the security team wants developers to see scan results directly in their pull requests and be able to assign remediation tasks to specific team members. Which feature should the team enable in the SAST tool or its integration?

   • AA dashboard in the SAST tool that shows all findings across the organization.
   • BA nightly email report sent to the security team only.
   • CA webhook that sends raw scan results to a SIEM system.
   • DPull request comments and status checks that include a link to the SAST tool's issue tracker.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A team wants to integrate a SAST tool with a repository hosted on an on-premises Git server that does not support webhooks. The team needs scans to run automatically after every push and findings to be posted as comments on the corresponding commit. What is the most effective integration approach?

   • ASet up a cron job on the SAST server to scan the repository every hour.
   • BUse a CI/CD pipeline that polls the repository for changes and triggers the SAST scan, with the SAST tool posting comments to the commit.
   • CConfigure the SAST tool to scan the repository on a schedule and email findings to the team.
   • DUse the SAST tool's API to manually trigger scans after each push.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A team uses GitLab and wants SAST scans to run when a merge request is created, but not on every push to the source branch. The SAST tool integrates via webhook. Which webhook event should the team subscribe to?

   • ATag events
   • BPush events
   • CMerge Request events
   • DPipeline events
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A SAST tool needs to access a repository hosted on an internal Git server. The security team requires that the SAST tool's credentials be scoped to read-only access and that the connection be encrypted. The Git server supports SSH keys and HTTPS with personal access tokens. Which configuration should be used?

   • AGenerate an SSH key pair, add the public key to the Git server with read-only access, and configure the SAST tool to use the private key.
   • BCreate a personal access token with write access and use it over HTTPS.
   • CConfigure the SAST tool to use a shared service account password over HTTPS.
   • DUse the SAST tool's built-in credentials with full access over an unencrypted HTTP connection.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company uses a SAST tool that only supports API-based integration. The team wants to trigger scans on every push to the 'main' branch in GitHub. The team also wants to ensure that the API call is authenticated securely and that the SAST tool's credentials are not exposed to developers. What should the team do?

   • AUse a webhook to call the SAST tool's API directly from GitHub.
   • BStore the SAST tool's API key in the repository's README for easy access.
   • CCreate a GitHub Action that runs on push to 'main' and calls the SAST tool's API using a secret stored in GitHub Secrets.
   • DHave the SAST tool poll the GitHub API for changes every minute.
   Reveal Solution Discussion Select an answer first