Scanning Code Repositories ECDE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A secrets scanner is integrated into the CI pipeline and fails the build when a potential secret is found. A developer accidentally commits a test API key that is not a real credential. The build fails. What should the developer do?

   • ARemove the test key from the code and use a placeholder or environment variable.
   • BAdd the test key to the scanner's allowlist and push again.
   • CDisable the secrets scanner in the pipeline.
   • DForce-push the commit to bypass the scanner.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following best describes what dependency scanning tools typically check?

   • AThe container image layers for malware signatures
   • BThe application's runtime behavior under malicious input
   • CThe source code for insecure coding patterns
   • DThe versions of libraries and packages against known vulnerability databases
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A container image scanning tool reports a vulnerability in a package that is installed but not used by the application. The team wants to reduce the attack surface and minimize false positives. What is the best approach?

   • AAdd a suppression rule for the vulnerability with a justification.
   • BUse a different base image that does not include the package.
   • CIgnore the vulnerability because the package is not used.
   • DRemove the unused package from the Dockerfile and rebuild the image.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A Java application uses a library with a known critical vulnerability. The dependency scanner flags it, but the library is used in a non-network-facing module. The security team wants to enforce a policy that does not block the release but still tracks the issue. Which policy configuration best fits this requirement?

   • ASet the scanner to fail the build on any critical vulnerability, regardless of context.
   • BRemove the dependency from the codebase immediately.
   • CIgnore the vulnerability because it is not in a network-facing module.
   • DConfigure the scanner to report the vulnerability but allow the build to pass, and create a tracking ticket for remediation.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary benefit of integrating scanning tools into a CI/CD pipeline?

   • AIt eliminates the need for any manual security testing
   • BIt ensures that every code change is automatically scanned for security issues before deployment
   • CIt guarantees that no vulnerabilities will ever reach production
   • DIt speeds up the build process by skipping security checks
   Reveal Solution Discussion Select an answer first