Software Composition Analysis (SCA) ECDE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An SCA tool reports that a dependency version is vulnerable according to the NVD. However, the development team argues that the vulnerable function is not used in their code. What should the security team do to validate this claim?

   • AUse a reachability analysis tool to determine if the vulnerable code path is actually called by the application.
   • BIgnore the NVD entry because it is often inaccurate.
   • CAccept the team's claim and mark the finding as a false positive.
   • DUpgrade the dependency anyway to be safe.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A startup is building a web application using many open-source libraries. The CTO wants to understand the security and legal risks associated with these dependencies before launch. Which practice provides the most comprehensive view?

   • AReview the licenses of only the direct dependencies listed in the project's README.
   • BRun an SCA tool that identifies all direct and transitive dependencies, checks them against vulnerability databases, and reviews their licenses.
   • CHire a security consultant to manually review the codebase for security issues.
   • DUse a vulnerability scanner that only scans the production servers for known CVEs.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is a key role of Software Composition Analysis (SCA) in the software development lifecycle?

   • AEnforcing coding standards and style guidelines
   • BMeasuring code coverage of automated tests
   • CDetecting secrets and credentials accidentally committed to the repository
   • DProviding visibility into open-source components and their associated risks
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which public database is the U.S. government's primary repository for publicly disclosed software vulnerabilities?

   • ACWE
   • BMITRE ATT&CK
   • COWASP Top 10
   • DNVD
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An SCA tool reports a vulnerability in a dependency, but the CVE entry in the NVD has a status of 'Disputed' and the vendor claims it is not a vulnerability. The dependency is widely used and the vulnerable function is called in the application's code. What is the best approach?

   • ATreat the finding as a potential risk, perform a manual code review to assess exploitability, and consider a workaround or upgrade if feasible.
   • BImmediately upgrade the dependency to the latest version, even if it introduces breaking changes.
   • CIgnore the finding because the CVE is disputed and the vendor says it is not a vulnerability.
   • DSuppress the finding permanently because the CVE is disputed.
   Reveal Solution Discussion Select an answer first