Software Composition Analysis (SCA) ECDE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company must provide a Software Bill of Materials (SBOM) for a legacy application that was built without any dependency management tools. The source code is available, but there are no lock files or manifests. The security team needs to generate an SBOM for the next audit. What is the most reliable approach?

   • AUse a source-code scanner that analyzes imports and includes to identify dependencies, then manually verify the list with the development team.
   • BAsk the development team to write a list of dependencies from memory.
   • CSkip the SBOM generation because the application is legacy and not subject to the audit.
   • DRun a binary scanner on the compiled application to identify embedded components.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An SCA scan reports a high-severity vulnerability in a transitive dependency of a Java application. The security team investigates and finds that the vulnerable code path is never executed because the application does not use the affected class. What should the team do?

   • ADocument the finding as a false positive or non-exploitable and suppress it with a justification, while monitoring for future changes.
   • BRemove the transitive dependency by deleting it from the lock file.
   • CImmediately upgrade the transitive dependency to the latest version regardless of compatibility.
   • DIgnore the finding because the vulnerability is in a transitive dependency and not directly controlled by the team.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Why is an SBOM important for vulnerability tracking?

   • AIt replaces the need for SCA scanning
   • BIt allows organizations to quickly identify which components are affected by a newly disclosed vulnerability
   • CIt guarantees that all dependencies are secure
   • DIt automatically patches all vulnerable components
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A Python application uses a popular library that has a known critical vulnerability. The latest patched version of the library is available, but it requires a newer version of Python than the application currently uses. The team cannot upgrade the Python runtime in the current release cycle. What is the most appropriate remediation strategy?

   • AApply a workaround, such as a configuration change or input validation, to mitigate the vulnerability while planning a runtime upgrade.
   • BDisable the SCA gate for this library until the runtime is upgraded.
   • CRemove the library from the project and rewrite all functionality that depends on it.
   • DForce the library upgrade anyway and accept the risk of runtime incompatibility.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A critical vulnerability is disclosed in a widely used open-source library. The patched version is available, but it introduces a breaking API change that affects multiple modules in the application. The team must release a security fix within a week. What is the most balanced approach?

   • AFork the library and backport only the security fix to the old version.
   • BPin the library to the vulnerable version and document the risk in the release notes.
   • CUpgrade the library and refactor the affected modules to use the new API, with thorough testing, even if it requires overtime.
   • DApply a temporary workaround to mitigate the vulnerability and defer the upgrade to the next release cycle.
   Reveal Solution Discussion Select an answer first