When a patched version of a vulnerable dependency is not available, which of the following is a possible remediation strategy?

Removing all dependencies from the project

Ignoring the vulnerability until a patch is released

Changing the project's programming language

Implementing a workaround, such as input validation or disabling the vulnerable feature

Why is license compliance an important part of Software Composition Analysis?

To avoid legal risks by ensuring that dependency licenses align with organizational policies

To verify that all dependencies are free of charge

To confirm that the project does not use any open-source code

To ensure that all open-source licenses are approved by the OSI

A company is considering using a library that is licensed under the Apache 2.0 license. The company's policy allows permissive licenses but requires attribution. What should the team do to comply with the license?

Remove the library from the project to avoid any legal risk.

Contact the library author for written permission to use the library.

Include the license text and attribution notices in the application's documentation or distribution.

Do nothing because Apache 2.0 is a permissive license with no obligations.

An organization's legal team requires that all open-source dependencies used in a new product must have licenses compatible with the company's proprietary distribution model. The development team is about to add a library that is licensed under the GNU General Public License (GPL). What should the team do first?

Rewrite the library's functionality from scratch to avoid any license obligations.

Add the library to the project and rely on the legal team to review the license after the release.

Run an SCA scan to confirm the exact license of the library and check it against the organization's approved license list.

Use the library only in internal testing and exclude it from the production build.

EC-CouncilCertified DevSecOps Engineer

Domain 2Objective 5

Software Composition Analysis (SCA) ECDE Practice Questions (Page 8)

Part of the Plan Stage: Threat Modeling and Pre-Commit Security domain, which makes up ~19% of our current practice bank.

44questions here

9free pages

9concepts

Questions 36–40

36foundation · easy
When a patched version of a vulnerable dependency is not available, which of the following is a possible remediation strategy?
Select an answer first
37foundation · easy
Why is license compliance an important part of Software Composition Analysis?
Select an answer first
38application · medium
A company is considering using a library that is licensed under the Apache 2.0 license. The company's policy allows permissive licenses but requires attribution. What should the team do to comply with the license?
Select an answer first
39application · medium
An organization's legal team requires that all open-source dependencies used in a new product must have licenses compatible with the company's proprietary distribution model. The development team is about to add a library that is licensed under the GNU General Public License (GPL). What should the team do first?
Select an answer first
40foundation · easy
Which file is most commonly used to identify the exact versions of direct and transitive dependencies in a JavaScript (npm) project?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECDE” is a trademark of its owner, used for identification only.

Software Composition Analysis (SCA) ECDE Practice Questions (Page 8)

Questions 36–40

When a patched version of a vulnerable dependency is not available, which of the following is a possible remediation strategy?

Why is license compliance an important part of Software Composition Analysis?

A company is considering using a library that is licensed under the Apache 2.0 license. The company's policy allows permissive licenses but requires attribution. What should the team do to comply with the license?

Which file is most commonly used to identify the exact versions of direct and transitive dependencies in a JavaScript (npm) project?

Keep studying — Plan Stage: Threat Modeling and Pre-Commit Security