Security Quiz - June 2023

Which of these security issues are considered as ‘compromised’ when it is discovered?

• Dependabot alert

• CodeQL finding

• Secrets exposed in code

• Vulnerability in a container

What is ETA/SLA (Service Level Agreement) to fix a ‘CRITICAL’ security finding?

• 2 Days

• 5 Days

• 7 Days

• 1 Month

Which of this tool help us to find the vulnerable package which are used by the attackers in ‘supply chain attack’?

• Dependabot alert

• Secrets exposed in code

• CodeQL finding

• Vulnerability in a container

What is the name of the ‘event’ that is run by secure code warrior?

• Capture the flag

• Secure Code Warrior

• Optum Security Advocate

Who is responsible for Application Security?

• Product Owner

• Developer

• Enterprise Information Security (EIS)

• Everyone is responsible

Where can I view the vulnerable packages (dependabot alert) used in the project?

• In GitHub Security Tab

• In Developer Workspace such as Visual Studio Code

• In Security Platform

Equifax, one of the largest credit reporting in the US, suffered a massive data breach that affected 147 million consumers, had to pay a $575 million as penalty. Guess, what caused this attack?

• Misconfigured security settings

• 'Secret’ exposed in code

• Failed to upgrade the package in a timely manner

The Artifacts that have Common Vulnerability Scoring System (CVSS) score is blocked (Marked as End of life) by EIS from using these libraries in the project

• CVSS Score of 1

• CVSS Score of 9.8

• CVSS Score of 5

• CVSS Score of 8

Which of these are considered as ‘Secrets’ and not to be kept in code?

• Credentials

• API Key

• Access Tokens

How does employing tools like CodeQL early in the development cycle help minimize the blast radius of potential security incidents?

• By reducing code’s runtime

• By making code more readable

• By helping developers detect and fix issues before the code is deployed

• By helping developers detect and fix issues after the code is deployed