Checkmarx CxCE flashcards
Checkmarx CxCE · Build recall with a focused review session.
34 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Source in taint analysis
- An entry point where untrusted data enters the application, such as an HTTP request parameter, header, cookie, file read, or database read. A finding requires a path from a source to a sink.
- Sink in taint analysis
- A dangerous operation that must not receive untrusted data, such as a SQL query execution, OS command call, file path open, or HTML response write. Reaching a sink without sanitization produces a finding.
- Contextual output encoding
- Encoding applied for the exact output context (HTML body, attribute, JavaScript string, URL, CSS). Encoding for the wrong context leaves the value exploitable, producing a false negative in SAST results.
- Incremental versus full scan
- A full scan analyzes the entire codebase; an incremental scan analyzes only files changed since the baseline. Incremental scans are faster but may miss cross-file flows into unchanged code.
- False negative
- A real vulnerability the scanner fails to report, typically caused by unresolved framework calls, reflection, dynamic dispatch, missing dependencies, over-broad exclusions, or unrecognized sanitizers.
- CWE-89 SQL injection
- Improper neutralization of special elements in SQL commands. Remediated with parameterized queries or prepared statements rather than string concatenation of user input.
- CxManager role
- The central Checkmarx CxSAST component providing the web interface, REST API, scheduling, access control, and results storage on a SQL Server database. Engines register with it.
- CxEngine role
- The scan worker component that executes the query pipeline against uploaded source. Scan throughput scales with the number of registered engines and their configured scan slots.
- CxAudit
- The desktop client used to write, test, and debug CxQL queries and to upload custom query sets to the CxSAST manager.
- Team-based project access
- Checkmarx access control combines a user role with team membership on a project; effective permissions are the intersection. A user outside the owning team cannot see the project.
- Result state persistence
- Triage states such as Confirmed, Not Exploitable, and Fixed are attached to individual results and carried across rescans by result matching, preserving analyst effort.
- Query preset
- A named collection of query groups assigned to a project that determines which vulnerability classes the scan can report. Changing the preset changes both coverage and scan duration.
- Scan exclusions
- Configured folder, file, or extension patterns skipped during scanning. Useful for generated code and third-party libraries, but over-broad exclusions cause false negatives.
- Scheduled versus triggered scan
- Scheduled scans run on a recurring interval defined per project; triggered scans are launched on demand through the API or CI/CD plugin and bypass the schedule.
- Custom query set
- A preset built from a base set by adding or modifying queries in CxAudit and uploading to the manager, allowing project-specific detection logic and sanitizer definitions.
- Scan priority
- A setting on on-demand scans that determines queue position. High-priority scans run before lower-priority queued scans, which matters when a release gate is waiting.
- Not Exploitable state
- The documented false-positive triage state, usually recorded with a reason. It persists across rescans via result matching but is reset if the project or query set changes.
- Scan comparison
- A view showing new, fixed, and recurring results between two scans. Used to measure remediation progress instead of raw open-finding counts, which fluctuate with code churn.
- Result fingerprint
- The identity used to match a finding across scans, based on file, location, and query. Large refactors can break matching and resurface previously triaged results.
- Attack path view
- The result detail showing source, propagation steps, and sink for a taint finding. Results without a complete path usually come from logic or configuration queries.
- CxQL query metadata
- The header of a CxQL query declaring its name, severity, CWE, language, and query group. Severity in the header becomes the severity of every result the query produces.
- CxQL sanitizer declaration
- A query construct that tells the engine a given call neutralizes taint. Correct sanitizer declarations remove false positives on framework-specific escaping paths.
- Non-taint CxQL query
- A query that matches a single structural pattern, such as a hardcoded credential, weak cipher constant, or missing security header, without tracking source-to-sink dataflow.
- Query language scoping
- Each CxQL query targets one programming language. A multi-language project needs queries for every language present, or findings in the other languages will be missed.
- REST API token authentication
- Checkmarx integrations authenticate to obtain a token, then send it as a header credential on later calls. Tokens expire, so automation must refresh them.
- Asynchronous scan polling
- Triggering a scan returns a scan identifier, not results. The pipeline must poll scan status or use a callback before fetching the report.
- Build gate threshold
- A CI/CD rule that fails the build on new findings at or above a chosen severity. Gating on new findings avoids blocking pipelines on pre-existing legacy debt.
- IDE plugin scan
- A plugin that scans the open project from the IDE and shows results inline. It uses the same project and preset configuration as pipeline scans, so results should agree.
- Parameterized query fix
- The remediation for SQL injection: bind user input as parameters so it is never concatenated into the SQL text, removing the taint path to the query sink.
- Remediation priority rule
- Rank by reachability from untrusted input and severity first, then by fix cost. A reachable High finding outranks an unreachable High finding with the same severity label.
- Mean time to remediate
- A program-health metric measuring elapsed time from finding creation to a Fixed state, tracked by severity. More informative than raw open-finding counts.
- SCA transitive dependency
- A library pulled in indirectly by a direct dependency. It is still in scope for SCA, and remediation often means upgrading the direct dependency that brings it in.
- Lock file accuracy in SCA
- SCA matches components using resolved versions. Lock files give exact versions, while manifest version ranges can cause mismatches or missed vulnerability matches.
- SBOM
- A software bill of materials listing components and versions in use. It supports audit and rapid impact assessment when a new CVE is published for a known component.