Software Composition Analysis (SCA) ECDE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An SCA tool reports a vulnerability in a dependency, but the vulnerability is not listed in the NVD. The tool uses a commercial vulnerability database. The team is unsure whether to trust the finding. What is the best way to validate the finding?

   • AUpgrade the dependency immediately to be safe.
   • BCheck the commercial database's advisory for details and cross-reference with the vendor's security advisories.
   • CAssume the finding is a false positive.
   • DIgnore the finding because it is not in the NVD.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A critical vulnerability is found in a dependency that is used in a legacy application. The application is no longer actively developed, but it is still in production. The team cannot upgrade the dependency because it would break the application, and there is no budget for a rewrite. What is the best remediation strategy?

   • AAccept the risk without any action.
   • BTake the application offline until the dependency can be upgraded.
   • CFork the dependency and maintain a patched version internally.
   • DImplement compensating controls, such as network segmentation or input validation, to reduce the exploitability of the vulnerability.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A team is using a commercial SCA tool in their CI pipeline. The tool currently only reports vulnerabilities in direct dependencies. The security team wants to ensure that vulnerabilities in transitive dependencies are also caught before release. What should they do?

   • ASwitch to a different SCA tool that only scans direct dependencies.
   • BConfigure the SCA tool to perform a full dependency tree scan, including transitive dependencies, and set the build to fail on critical findings.
   • CDisable the SCA gate and rely on the security team to review dependencies after release.
   • DAsk developers to manually check the transitive dependencies listed in the lock file.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A development team uses a Node.js project with a package-lock.json file. The security lead wants to generate a complete inventory of all open-source components, including those pulled in transitively, to cross-reference against the NVD before the next release. Which approach best satisfies this requirement?

   • AUse a runtime scanner that inspects the production container image and reports only packages that are actively loaded in memory.
   • BQuery the NVD directly for all package names found in the project's README file.
   • CRun an SCA tool that parses package-lock.json and resolves the full dependency tree, then export the results as an SBOM.
   • DManually review the package.json file and list only the direct dependencies declared by the team.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the purpose of triaging SCA findings?

   • ATo determine which findings are real and require action
   • BTo generate a list of all dependencies in the project
   • CTo automatically fix all identified vulnerabilities
   • DTo update the vulnerability database used by the SCA tool
   Reveal Solution Discussion Select an answer first