Software Composition Analysis (SCA) ECDE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company is required to provide an SBOM for each software release to a customer. The SBOM must be generated automatically and attached to the release artifacts. What is the best way to implement this?

   • AAdd a step in the CI pipeline that generates the SBOM and publishes it as a release artifact.
   • BGenerate the SBOM manually before each release.
   • CUse the SBOM from the previous release and update it with a text editor.
   • DAsk the customer to generate the SBOM from the release artifacts.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company must provide a list of all open-source components used in a mobile application to a customer for their security review. The application is built from a monorepo containing multiple packages. What is the best way to produce this list?

   • AGenerate an SBOM from the build process that aggregates the dependency trees of all packages in the monorepo.
   • BList only the direct dependencies declared in each package's manifest file.
   • CAsk each developer to manually document the libraries they used in their code.
   • DUse the output of a runtime scanner that only reports components loaded during a manual test session.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A startup is building a new web application and plans to use several open-source libraries. The CTO wants to understand the security and legal risks of using these libraries before committing to them. What is the most effective way to assess these risks?

   • ARun an SCA scan on the project after adding the dependencies and review the vulnerability and license report.
   • BRead the documentation of each library to check for known issues.
   • CAsk the library maintainers for a security audit report.
   • DSearch the internet for news about each library's security incidents.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   An SCA scan reports a critical vulnerability in a transitive dependency. The vulnerability is in a function that the application never calls, and the vulnerable code path is not reachable. The team is under pressure to release a feature. What is the most appropriate action?

   • AReplace the entire dependency with a different library to avoid the vulnerability.
   • BIgnore the finding because the vulnerability is not exploitable.
   • CDocument the finding, verify the reachability analysis, and if confirmed unreachable, suppress the finding with a justification and proceed with the release.
   • DImmediately upgrade the transitive dependency to the patched version, even if it introduces breaking changes.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An organization must provide a software bill of materials (SBOM) for every container image deployed to production. The SBOM must include all open-source components, including those from base images. What is the most reliable way to generate this SBOM?

   • AGenerate the SBOM from the application's source code manifest only.
   • BGenerate the SBOM by scanning the final container image with an image scanner that produces an SBOM.
   • CManually compile a list of dependencies from the Dockerfile and application manifests.
   • DUse only the SBOM generated by the base image provider.
   Reveal Solution Discussion Select an answer first