Integrating the Code Repo to SAST Tools ECDE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A SAST tool is integrated with a GitHub repository via webhook. The security team wants to ensure that developers are notified of new findings and that the findings are tracked until they are fixed. Which feedback-loop mechanism should the team configure?

   • ADisplay the findings on a dashboard that only the security team can access.
   • BSend a Slack message to the security team with a list of all findings.
   • CStore the findings in a CSV file and share it via email weekly.
   • DAutomatically create a GitHub issue for each new finding and assign it to the developer who committed the code.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   To ensure that every code change is scanned, a SAST tool should be configured to trigger on which repository event?

   • ARelease publish
   • BIssue close
   • CPull request review
   • DPush
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   After integrating a SAST tool with Azure DevOps, the security team wants scan findings to appear as comments on the pull request that introduced the vulnerability, so developers can fix issues before merging. Which configuration should be used to achieve this feedback loop?

   • AStore scan results in a separate security dashboard and require developers to check it manually.
   • BEnable the SAST tool's pull request comment feature and configure it to post findings to the source branch of the pull request.
   • CConfigure the SAST tool to send a summary email to the development team after each scan.
   • DSet up the SAST tool to automatically merge the pull request if no critical findings are detected.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A SAST tool is being configured to scan a Git repository that contains both source code and large binary files. The team wants to scan only the source code and avoid scanning the binaries to save time. The SAST tool supports path filters and file-type filters. The team also wants to ensure that the SAST tool's credentials are not exposed to developers. Which configuration should the team use?

   • AScan the entire repository and rely on the SAST tool to skip binary files automatically.
   • BConfigure a path filter to exclude the binary directories and use a service account with read-only access.
   • CUse a webhook to trigger scans only when source files are changed, and store the token in the SAST tool's configuration file.
   • DConfigure a file-type filter to scan only source code extensions and use a personal access token of the repository owner.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   When configuring a SAST tool to connect to a private code repository, which of the following is typically required to authenticate the SAST tool?

   • APersonal access token
   • BBranch name
   • CRepository URL only
   • DCommit hash
   Reveal Solution Discussion Select an answer first