Software Composition Analysis (SCA) ECDE Practice Questions (Page 9)

Questions 41–44

1. 41expert · hard

   An SCA scan reports a vulnerability in a dependency, but the vulnerability is in a platform-specific module that is not used on the target operating system. The team is deploying to Linux, and the vulnerable module is for Windows. What should the team do?

   • AUpgrade the dependency to the latest version to eliminate the vulnerability.
   • BDeploy to Windows instead to avoid the vulnerability.
   • CVerify that the vulnerable module is not included in the Linux build, then suppress the finding with a platform-specific justification.
   • DIgnore the finding because it is not relevant to Linux.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A team is using OWASP Dependency-Check in their CI pipeline. They notice that the scan takes too long and is slowing down the pipeline. What is the most effective way to reduce scan time without losing vulnerability coverage?

   • ADisable the scan for transitive dependencies.
   • BUse a locally cached copy of the NVD data feed.
   • CIncrease the timeout for the scan step.
   • DRun the scan only on release branches.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A security team needs to choose an SCA tool for a multi-language monorepo that includes Java (Maven), Python (pip), and JavaScript (npm). The tool must be able to scan all three languages and integrate with their Jenkins pipeline. Which tool selection is most appropriate?

   • AA tool that only supports Java, because the team can manually check Python and JavaScript dependencies.
   • BA commercial tool that only supports npm, because JavaScript is the most critical language.
   • CA custom script that greps for dependency names in all source files.
   • DOWASP Dependency-Check, because it supports multiple languages and has a Jenkins plugin.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which of the following is a common remediation action for a vulnerable open-source dependency?

   • ADeleting the lock file to force a fresh resolution
   • BUpdating the dependency to a patched version
   • CIgnoring the vulnerability if it is not in the production code path
   • DRenaming the dependency package
   Reveal Solution Discussion Select an answer first