Integrating the Code Repo to SAST Tools ECDE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of assigning remediation tasks to developers based on SAST scan results?

   • ATo automatically fix the vulnerabilities
   • BTo ensure that identified vulnerabilities are tracked and fixed
   • CTo block all code changes
   • DTo generate a compliance report
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A SAST tool is being configured to scan a monorepo that contains multiple projects. The team wants to scan only the 'backend' directory and exclude the 'legacy' directory. The SAST tool supports path filters during repository configuration. What should the team configure to achieve this?

   • AConfigure the SAST tool to scan the entire repository without any filters.
   • BSet only an include filter for 'backend/**'.
   • CSet only an exclude filter for 'legacy/**'.
   • DSet an include filter for 'backend/**' and an exclude filter for 'legacy/**'.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A SAST tool posts scan results as comments on GitHub pull requests. The team notices that the same vulnerability is being reported on every commit to the PR, creating a long list of duplicate comments. The team wants to reduce noise while still ensuring that the developer sees the finding. What should the team configure?

   • APost the results only once when the PR is merged.
   • BConfigure the SAST tool to update the existing comment on the PR instead of creating a new one for the same vulnerability fingerprint.
   • CSend the results to a separate Slack channel instead of the PR.
   • DDisable SAST scans on subsequent commits to the PR.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which repository event is most commonly used to trigger a SAST scan to provide immediate feedback to developers before code is merged?

   • AIssue comment
   • BPull request
   • CTag creation
   • DRepository fork
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company uses Bitbucket Cloud and wants SAST scans to run on every pull request, but only on the code changes introduced by that pull request. The team wants to avoid scanning the entire codebase on every PR to save compute time. Which approach should they use?

   • AUse a CI/CD pipeline that runs SAST on the entire repository after each merge to the main branch.
   • BSet up a scheduled scan that runs nightly on the default branch and reports all findings.
   • CConfigure a Bitbucket webhook for pull request events and have the SAST tool perform a diff-based scan against the target branch.
   • DManually trigger a SAST scan from the SAST tool's UI whenever a PR is created.
   Reveal Solution Discussion Select an answer first