Software Composition Analysis (SCA) ECDE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   An SCA tool flags a critical vulnerability in a transitive dependency that is used only in a test module of a Java application. The vulnerable library is not packaged into the production artifact. The team has a strict policy that all critical findings must be remediated before release. The library has no patched version available. What is the best course of action?

   • ADocument that the vulnerable component is test-only and not shipped, suppress the finding with a justification, and set a review date to re-check for a patch.
   • BRemove the transitive dependency by overriding the version in the build file to a non-vulnerable version that is not compatible with the test framework.
   • CFail the release and block the product launch until a patched version of the library is released by the upstream project.
   • DReplace the test module with a different testing framework that does not use the vulnerable library.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A critical vulnerability is found in a transitive dependency. The direct dependency that pulls it in does not have a patched version that updates the transitive dependency. The team cannot replace the direct dependency because it is central to the application. What is the best remediation strategy?

   • AFork the direct dependency and patch the transitive dependency yourself.
   • BAccept the risk and do nothing because the direct dependency is essential.
   • CUse a dependency override or resolution to force the transitive dependency to a patched version, if compatible.
   • DRemove the direct dependency and rewrite the functionality.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A development team is using a package manager that supports lock files, but the lock file is not committed to the repository. The CI pipeline runs SCA scans on every commit. What is the most likely consequence of not committing the lock file?

   • AThe SCA scan will be faster because there is no lock file to parse.
   • BThe SCA scan will only scan direct dependencies, missing transitive dependencies.
   • CThe SCA scan will fail because the lock file is required by the tool.
   • DThe SCA scan may report different dependency versions across builds, leading to inconsistent vulnerability results and potential false positives or missed vulnerabilities.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is a 'security gate' in the context of CI/CD integration of SCA?

   • AA step that encrypts all source code before deployment
   • BA manual approval step that requires a human to review every dependency
   • CA firewall rule that blocks network traffic to the CI/CD server
   • DA condition that fails the build if SCA findings exceed a defined threshold
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security auditor asks for a complete list of all open-source components in a deployed application, including those from base images and build tools. What is the best source for this information?

   • AThe application's package.json file.
   • BThe Dockerfile's FROM line.
   • CThe CI pipeline's build logs.
   • DThe SBOM generated from the final container image.
   Reveal Solution Discussion Select an answer first