312-97: EC-Council Certified DevSecOps Engineer (ECDE)Demo

By ECCouncil · Question Mode

QuestionQ37

DevSecOps Pipeline-Code Stage

Lisa Kramer has 4 years of experience as a DevSecOps engineer at an IT company. The software development team in her organization has built a Ruby on Rails web application and wants to identify vulnerabilities in its Ruby dependencies. The team leader of the software development team has reached out to Lisa for assistance with this task.

Which of the following SCA (Software Composition Analysis) tools should Lisa use to detect vulnerabilities in the Ruby dependencies?

  • A Bundler-Audit
  • B Bandit
  • C Retire.js
  • D Tenable.io
Explanation

Bundler-Audit is an SCA tool purpose-built for Ruby applications. It scans a project's Gemfile.lock to check installed gem versions against the Ruby Advisory Database (a database of known Ruby gem vulnerabilities), flagging insecure or outdated dependencies. Bandit is a SAST tool for Python source code, Retire.js targets vulnerable JavaScript libraries, and Tenable.io is a broader vulnerability management/scanning platform rather than a dependency-specific SCA tool for Ruby. Since the requirement is specifically to find vulnerabilities in Ruby dependencies of a Ruby on Rails application, Bundler-Audit is the appropriate tool.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!