Why is it beneficial to integrate SCA scanning into the CI/CD pipeline?

To eliminate the need for runtime monitoring

To replace the need for manual code reviews

To ensure that all dependencies are free of any known vulnerabilities

To automatically detect vulnerabilities in dependencies early in the development process

A development team is preparing to integrate SCA into their CI pipeline. They need to ensure that the scanner can identify all vulnerable components, including those pulled in indirectly. The team has a lock file that pins exact versions of every installed package. Which action best ensures the SCA tool can map the full dependency tree to known vulnerabilities?

Run the SCA tool against the production environment's installed packages.

Configure the SCA tool to use the lock file as the source of truth for dependency resolution.

Ask developers to manually list all dependencies in a spreadsheet for the scanner to ingest.

Generate an SBOM from the source code repository and scan only the SBOM.

A team wants to integrate SCA into their CI pipeline, but they have a mix of applications: some are critical and some are low-risk internal tools. They want to enforce a security gate that is appropriate for each application's risk level. What is the best approach?

Do not enforce any gate; just generate reports for manual review.

Only scan critical applications and ignore low-risk tools.

Use different SCA policies for different projects, with stricter thresholds for critical applications.

Use the same strict policy for all applications.

A DevOps team wants to add SCA scanning to their CI pipeline. They want to fail the build only when a critical or high severity vulnerability is found in a direct dependency. They also want to allow the pipeline to continue for medium severity issues. Which CI configuration approach meets these requirements?

Configure the SCA tool to fail the build on any vulnerability and then manually review the report.

Use the SCA tool's built-in policy to fail the build when a critical or high vulnerability is found in a direct dependency, and log medium issues as warnings.

Run the SCA scan as a post-build step and send the report to the team via email.

Set the SCA tool's fail-on-severity threshold to 'high' and exclude transitive dependencies from the scan.

What is the primary output of an SCA tool scan?

A list of network ports open on the application server

A list of user permissions and access controls

A list of code smells and anti-patterns in the source code

A list of open-source dependencies with identified vulnerabilities and license information

EC-CouncilCertified DevSecOps Engineer

Domain 2Objective 5

Software Composition Analysis (SCA) ECDE Practice Questions (Page 1)

Part of the Plan Stage: Threat Modeling and Pre-Commit Security domain, which makes up ~19% of our current practice bank.

44questions here

9free pages

9concepts

Questions 1–5

1foundation · easy
Why is it beneficial to integrate SCA scanning into the CI/CD pipeline?
Select an answer first
2application · medium
A development team is preparing to integrate SCA into their CI pipeline. They need to ensure that the scanner can identify all vulnerable components, including those pulled in indirectly. The team has a lock file that pins exact versions of every installed package. Which action best ensures the SCA tool can map the full dependency tree to known vulnerabilities?
Select an answer first
3expert · hard
A team wants to integrate SCA into their CI pipeline, but they have a mix of applications: some are critical and some are low-risk internal tools. They want to enforce a security gate that is appropriate for each application's risk level. What is the best approach?
Select an answer first
4application · medium
A DevOps team wants to add SCA scanning to their CI pipeline. They want to fail the build only when a critical or high severity vulnerability is found in a direct dependency. They also want to allow the pipeline to continue for medium severity issues. Which CI configuration approach meets these requirements?
Select an answer first
5foundation · easy
What is the primary output of an SCA tool scan?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECDE” is a trademark of its owner, used for identification only.

Software Composition Analysis (SCA) ECDE Practice Questions (Page 1)

Questions 1–5

Why is it beneficial to integrate SCA scanning into the CI/CD pipeline?

A team wants to integrate SCA into their CI pipeline, but they have a mix of applications: some are critical and some are low-risk internal tools. They want to enforce a security gate that is appropriate for each application's risk level. What is the best approach?

What is the primary output of an SCA tool scan?

Keep studying — Plan Stage: Threat Modeling and Pre-Commit Security