2.5 Explain the Integration Process for Third-Party Static Application Security Testing (SAST) / Software Composition Analysis (SCA) Tools (e.g., Semgrep, Veracode, Generic SARIF) CLOUD-SECURITY-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   When mapping a third-party finding's severity to Prisma Cloud, what is the typical approach?

   • ATranslate the tool's severity values to Prisma Cloud's severity levels (e.g., critical, high, medium, low).
   • BDiscard severity information and rely only on the rule ID.
   • CAssign all findings a default severity of medium.
   • DUse the raw severity string exactly as provided by the tool.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A security engineer is integrating a third-party SAST tool into Prisma Cloud. According to the standard integration workflow, which step should occur first?

   • ACreate a new integration in Prisma Cloud and obtain the required credentials or tokens.
   • BConfigure the SAST tool to output results in a Prisma Cloud-compatible format.
   • CMap the third-party findings to Prisma Cloud's vulnerability schema.
   • DIdentify the integration type and prerequisites, such as API access and supported formats.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A development team uses a custom in-house static analysis tool that outputs findings in a proprietary JSON format. They want to import these results into Prisma Cloud so that developers see them alongside Prisma Cloud's own code security findings in the same console. The team cannot modify the tool's output format. What should the team do to integrate the tool with Prisma Cloud?

   • AConfigure the in-house tool to write results directly to a Prisma Cloud-managed storage bucket.
   • BUse the Prisma Cloud API to have the in-house tool call the vulnerability endpoint directly with its native JSON schema.
   • CAsk Prisma Cloud support to enable a custom parser for the proprietary JSON format.
   • DWrite a small conversion script that transforms the proprietary JSON output into a generic SARIF file, then submit the SARIF file to Prisma Cloud.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In the Prisma Cloud integration workflow for third-party SAST/SCA tools, what is the purpose of validating the connection after configuring the integration?

   • ATo ensure the third-party tool is licensed for commercial use.
   • BTo map the third-party findings to the correct compliance framework.
   • CTo update the third-party tool's vulnerability database.
   • DTo confirm that the third-party tool can send results and that Prisma Cloud can receive them.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security team is integrating Semgrep into their CI/CD pipeline. They want Semgrep findings to appear in Prisma Cloud with the correct severity levels and file locations. The team has already installed the Prisma Cloud CLI plugin. Which configuration step is essential to ensure the findings are properly mapped in Prisma Cloud?

   • AConfigure Semgrep to output SARIF format using --sarif and then use the Prisma Cloud CLI to submit the SARIF file.
   • BSet the Prisma Cloud CLI to use the --format=sarif option and point it at Semgrep's default output file.
   • CRun Semgrep with the --json flag and pipe the output directly to the Prisma Cloud CLI.
   • DEnsure Semgrep is run with the --severity=critical flag to filter results before submission.
   Reveal Solution Discussion Select an answer first