Checkmarx CxCE case studies
Checkmarx CxCE · Put your knowledge to work in context.
The Checkmarx Certified Engineer (CxCE) credential is aimed at security engineers, DevSecOps practitioners, and application security leads who administer and operate Checkmarx in real delivery pipelines rather than merely reading scan reports. It tests the working knowledge that separates someone who can install the platform from someone who can keep it producing trustworthy, actionable results across many projects and teams. Coverage spans static analysis fundamentals and secure coding concepts, platform architecture and administration, scan configuration through projects, presets, queries, and scheduling, results triage and false positive management, CxQL custom query development, IDE and CI/CD integration via plugins, CLI, and automation, remediation guidance and reporting, and open-source risk through software composition analysis. Expect scenario-based multiple choice: a noisy project, a broken pipeline gate, a query that returns too much, a deployment that will not scale. The Checkmarx CxCE case studies are 5 cases and about 3,491 words.
1The Validator That Only Guards One Door
Northwind Payroll runs a Java 11 Spring Boot monolith (about 850,000 lines) with 12 delivery teams. A nightly CxSAST scan on the Checkmarx Default preset reports 37 Command Injection flows in the reporting module.
781 words, about 4 min2The Queue That Outgrew the Engines
CxSAST 9.x on Windows: one CxManager, one SQL Server, four CxEngines, results on an SMB share. 2,800 projects; nightly schedule starts at 02:00 with 900 scans.
663 words, about 3 min3Triage at 6,240 Results with Two Champions
After a three-week scan of a 1.1M-line .NET solution, CxSAST returns 6,240 results: 4,870 To Verify, 900 Confirmed, and 470 Not Exploitable, mostly from a legacy module. Two security champions support 25 developers across four feature teams.
672 words, about 3 min4Teaching CxQL About a Home-Grown SQL Wrapper
Your company wraps cryptography and SQL in shared libraries. CryptoUtil.encrypt(String plaintext, String key) uses AES/ECB/PKCS5Padding; DbHelper.query(String sql) executes raw SQL.
693 words, about 3 min5The Pull-Request Gate Nobody Trusts
Contoso has 300 Git repositories in Azure DevOps. A Jenkins pipeline runs runCxConsole Scan synchronously on every pull request against a per-branch CxSAST project, then fails the build if any new High result appears.
682 words, about 3 min