2.5 Explain the Integration Process for Third-Party Static Application Security Testing (SAST) / Software Composition Analysis (SCA) Tools (e.g., Semgrep, Veracode, Generic SARIF) CLOUD-SECURITY-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security engineer uploads a SARIF file generated by a custom tool to Prisma Cloud. The upload succeeds, but the findings show 'Unknown' as the rule name and the description is empty. The SARIF file contains the rule information in the 'rules' array of the 'tool' object. What is the most likely issue?

   • AThe 'results' array references rule IDs that do not exist in the 'rules' array.
   • BThe SARIF file was generated with an older version of the SARIF specification.
   • CThe SARIF file uses 'shortDescription' instead of 'fullDescription' for the rule.
   • DThe 'tool' object is missing the 'driver' property.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of importing a SARIF file into Prisma Cloud?

   • ATo replace Prisma Cloud's built-in scanning capabilities.
   • BTo update the third-party tool's rule set.
   • CTo unify third-party SAST findings with Prisma Cloud's scanning results.
   • DTo convert SARIF files into PDF reports.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   When troubleshooting a failed webhook integration between a third-party SAST tool and Prisma Cloud, what should you check first?

   • AWhether the SAST tool has the latest version of its rule database.
   • BWhether the SAST tool is installed on a Windows server.
   • CWhether the SAST tool's output is in PDF format.
   • DWhether the webhook URL and authentication credentials are correct.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company uses a commercial SAST tool that only exports SARIF files. The security engineer uploads a SARIF file to Prisma Cloud, but the findings do not appear in the code security dashboard. The SARIF file opens correctly in a text editor and contains valid JSON. What is the most likely cause of the issue?

   • AThe SARIF file lacks the 'runs' array that contains the actual results.
   • BThe SARIF file was generated on a Windows machine and contains backslashes in file paths.
   • CThe SARIF file uses version 2.1.0, which Prisma Cloud does not support.
   • DThe SARIF file was compressed with gzip before upload, but the engineer did not specify the compression type.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A DevOps engineer is setting up an automated integration between a third-party SAST tool and Prisma Cloud using the Prisma Cloud API. The engineer wants to submit scan results from a Jenkins pipeline. The pipeline currently uses a Jenkins credential to authenticate to the Prisma Cloud API. The integration works, but the engineer is concerned about the security of the credential. What is the best practice for managing the Prisma Cloud API credential in Jenkins?

   • ACreate a new Prisma Cloud API key for each pipeline run and delete it after the run completes.
   • BUse the Prisma Cloud CLI with a configuration file that contains the API key, and store the file in the Jenkins workspace.
   • CHardcode the API key in the Jenkinsfile for simplicity, as the Jenkinsfile is stored in a private repository.
   • DStore the API key as a Jenkins secret text credential and reference it in the pipeline using the credentials binding.
   Reveal Solution Discussion Select an answer first