Integrating the Code Repo to SAST Tools ECDE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A development team uses GitHub Enterprise for source control and wants to run SAST scans only when a pull request is opened or updated, without modifying their existing CI/CD pipeline configuration. The SAST tool supports webhooks, API polling, and a Jenkins plugin. Which integration method should the team choose to meet the requirement with the least operational overhead?

   • AUse the SAST tool's API to poll the repository every five minutes for new pull requests.
   • BSet up the Jenkins plugin to trigger a SAST scan as a post-build step after every build.
   • CConfigure a webhook in GitHub Enterprise to send pull_request events to the SAST tool's API endpoint.
   • DCreate a GitHub Action that runs the SAST scanner on a cron schedule every hour.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company has a self-hosted Git server that does not support webhooks. The SAST tool supports API polling and CI/CD plugin integration. The team wants to run SAST scans on every push to the 'release' branch and also block the merge if critical findings exist. The CI/CD pipeline is Jenkins. What should the team do?

   • AUse the SAST tool's API to poll the repository every minute and trigger a scan, then manually review results.
   • BConfigure a Jenkins pipeline job that polls the repository for changes on the 'release' branch, runs the SAST plugin, and fails the build on critical findings.
   • CAsk the Git server administrator to enable webhooks.
   • DConfigure a cron job on the SAST server to clone the repository and run a scan, then email the results.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   A development team wants to run SAST scans as part of their existing Jenkins pipeline. Which repository integration method is most appropriate for this scenario?

   • AGit hook
   • BCI/CD pipeline plugin
   • CWebhook
   • DAPI connection
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A large organization uses multiple repositories across GitHub and GitLab. They want to integrate a single SAST tool that can scan code from both platforms, trigger scans on pull requests, and post findings back as comments. The SAST tool supports webhooks, API connections, and CI/CD plugins. What is the most efficient integration strategy?

   • ASet up API polling from the SAST tool to both GitHub and GitLab every minute.
   • BIntegrate only with GitHub and manually export GitLab code to the SAST tool for scanning.
   • CConfigure webhooks from both GitHub and GitLab to the SAST tool's API and enable the pull request comment feature for both platforms.
   • DUse separate CI/CD plugins for GitHub and GitLab, each configured to run scans and post comments.
   Reveal Solution Discussion Select an answer first
6. 25expert · medium

   A SAST tool is integrated with a GitLab repository using a personal access token of a developer. The developer leaves the company, and the token is revoked. The SAST scans start failing. The team wants to prevent this from happening again and also wants to follow least privilege. What should the team do?

   • AUse the GitLab admin password in the SAST tool.
   • BCreate a dedicated service account with read-only access to the repository, generate a new token for that account, and configure the SAST tool to use it.
   • CAsk the developer to create a new personal access token before leaving.
   • DConfigure the SAST tool to use SSH keys instead of tokens.
   Reveal Solution Discussion Select an answer first