Integrating the Code Repo to SAST Tools ECDE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A team uses GitHub and wants to run SAST scans on pull request updates, but not on the initial pull request creation. The SAST tool integrates via webhook. Which webhook event should the team subscribe to?

   • APull request opened events
   • BPull request synchronize events
   • CPush events to the default branch
   • DPull request review request events
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A team uses Jenkins for CI/CD and wants to integrate a SAST tool so that scans run automatically as part of the build pipeline for every commit pushed to the main branch. The SAST tool provides a Jenkins plugin and a REST API. Which integration method is most appropriate for this scenario?

   • AAdd the SAST plugin as a build step in the Jenkins pipeline for the main branch.
   • BSet up a separate Jenkins job that polls the repository every five minutes for changes.
   • CConfigure a webhook in the repository to call the SAST tool's REST API on push events.
   • DUse the SAST tool's API to manually trigger scans after each build completes.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security team is configuring a SAST tool to connect to a self-hosted GitLab instance. The SAST tool needs read access to all repositories in the 'development' group but must not be able to modify code or access other groups. Which configuration approach satisfies the least-privilege requirement?

   • AUse a project access token from one repository in the 'development' group and configure the SAST tool to scan all projects.
   • BConfigure the SAST tool with the Developer role on the 'development' group to ensure it can read all branches.
   • CCreate a GitLab service account with the Reporter role scoped to the 'development' group and use its personal access token in the SAST tool.
   • DGenerate a personal access token from a GitLab administrator account and provide it to the SAST tool.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A team uses GitHub and wants to run SAST scans on pull requests, but only when the PR modifies files in the 'src' directory. They also want to post a comment on the PR with the scan results. The SAST tool supports webhooks and a GitHub App. Which configuration should the team implement?

   • AConfigure a webhook for all pull request events and have the SAST tool scan the entire repository on every PR.
   • BConfigure a scheduled scan that runs nightly and posts results to open PRs.
   • CUse a CI/CD pipeline that runs SAST on every push to any branch and posts results to the PR.
   • DConfigure the GitHub App to receive pull request events, have it check the changed files for the 'src' path, and if matched, trigger the SAST scan and post a comment via the GitHub API.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A SAST tool needs to access a private repository in GitHub. The team wants to use a token that is automatically rotated and has the minimum permissions required for read-only access. Which token type should the team use?

   • AAn SSH key with read-only access.
   • BA GitHub App installation token with read-only contents permission.
   • CA personal access token (fine-grained) with read-only access to the repository.
   • DA personal access token (classic) with repo scope.
   Reveal Solution Discussion Select an answer first