Scanning Code Repositories ECDE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the purpose of defining severity thresholds in scanning policies?

   • ATo determine how often the repository should be backed up
   • BTo decide which programming languages are allowed in the repository
   • CTo assign a severity score to each developer based on their code quality
   • DTo determine which vulnerabilities must be fixed before a build can proceed
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A DevSecOps team wants to add SAST to their CI pipeline. The application is a Java Spring Boot service with a 10-minute build. They need to fail the build on any new critical vulnerability, but they want to avoid slowing down the pipeline. The SAST tool supports incremental scanning. What is the best approach?

   • ARun full SAST scan on every commit and fail the build on any critical finding.
   • BRun SAST on release branches only, with a manual review gate.
   • CRun SAST only on pull requests, using incremental scanning, and fail the PR check on new critical findings.
   • DRun SAST nightly on the main branch and report findings without blocking the build.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security team wants to enforce a policy that all SAST findings must be remediated before a release. However, developers are complaining that some low-severity findings are false positives. What is the best way to handle this?

   • ARequire developers to fix all findings, including false positives.
   • BLower the severity threshold so that only critical findings are reported.
   • CDisable the SAST tool because of the false positives.
   • DAllow developers to mark findings as false positives with a justification, and review them in the security team.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A team uses container images for their application. They want to enforce a policy that no image with critical vulnerabilities is deployed. However, some images are built from base images that have known critical vulnerabilities that cannot be fixed because no patched base image is available. The team wants to allow these images to be deployed while still enforcing the policy for other images. What is the best approach?

   • ACreate an exception list for specific base images that are known to have no fix, and require approval for their use.
   • BBlock all images with critical vulnerabilities, including those with no fix available.
   • CDisable the container image scanner for images that use the affected base image.
   • DAllow all images with critical vulnerabilities to be deployed, but log the risk.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A development team uses a monorepo containing multiple microservices. They want to run SAST on every pull request, but the full scan takes 25 minutes, which slows down the CI pipeline. The security team wants to keep the scan comprehensive but also wants to provide fast feedback to developers. Which approach best balances these needs?

   • ARun the full SAST scan only on the main branch and rely on code review for pull requests.
   • BRun a targeted SAST scan on changed files in the pull request, and run the full scan nightly or on merge to main.
   • CIncrease the CI runner resources so the full scan completes in under 5 minutes.
   • DDisable SAST in CI and run it only in the IDE for each developer.
   Reveal Solution Discussion Select an answer first