Which two situations are flagged by software tools designed for dependency checking in continuous integration environments, such as OWASP? (Choose two.)
A.
publicly disclosed vulnerabilities related to the included dependencies
B.
mismatches in coding styles and conventions in the included dependencies
C.
incompatible licenses in the included dependencies
D.
test case failures introduced by bugs in the included dependencies
E.
buffer overflows to occur as the result of a combination of the included dependencies
I agree with A and E:
OWASP Dependency Check is a well known open-source tool which can track dependencies in your project and identify components with dependencies and checks if there are any known, publicly disclosed, vulnerabilities.
Source code analysis tools, also referred to as Static Application Security Testing (SAST) Tools, are designed to analyze source code and/or compiled versions of code to help find security flaws. Useful for things that such tools can automatically find with high confidence, such as buffer overflows, SQL Injection Flaws, and so forth
A. Publicly disclosed vulnerabilities related to dependencies
This is correct because:
Security vulnerability scanning is a core function of dependency checkers
They check against databases of known CVEs and security advisories
This helps prevent using components with known security issues
C. Incompatible licenses in dependencies
This is also correct because:
License compliance is a critical aspect of dependency management
Tools check for conflicts between different open source licenses
This prevents legal issues from incompatible license combinations
This section is not available anymore. Please use the main Exam Page.350-901 Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
blezzzo
Highly Voted 4 years, 9 months agosamael666
7 months, 1 week agoFR99
Highly Voted 4 years, 10 months agoDASBOL
Most Recent 4 months, 4 weeks agoblurain
1 year, 11 months agodesignated
2 years, 9 months agoskysoft
2 years, 10 months agoMiSoledad
4 years, 7 months ago