I85PREP
⌘ K
Checkmarx CxCE study materials
Checkmarx CxCE study resources

Checkmarx CxCE practice questions

One question at a time. Build your Checkmarx CxCE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Static Application Security Testing (SAST) Fundamentals and Secure Coding Concepts

In a SAST tool, what does a 'source' represent?

  1. A sanitizer that encodes output
  2. A configuration file parsed at build time
  3. A sink that writes data to disk
  4. A point where untrusted input enters the application Correct answer.

Explanation

A source is the origin of data that may be attacker-controlled, such as HTTP request parameters, headers, or file input. SAST engines trace data flow from sources toward dangerous sinks to determine whether taint reaches them.

Question 2Static Application Security Testing (SAST) Fundamentals and Secure Coding Concepts

What is the primary purpose of data-flow (taint) analysis in a SAST engine?

  1. To enforce coding style rules automatically
  2. To determine whether untrusted data can reach a dangerous operation without sanitization Correct answer.
  3. To measure code coverage of unit tests
  4. To generate runtime fuzz inputs

Explanation

Taint analysis propagates a marker from sources to sinks and reports when the marker arrives unsanitized. This lets the tool distinguish exploitable flows from harmless data usage.

Question 3Static Application Security Testing (SAST) Fundamentals and Secure Coding Concepts

A developer concatenates a request parameter directly into a SQL statement. Which vulnerability class does this most directly represent?

  1. Path traversal
  2. Cross-site scripting
  3. SQL injection Correct answer.
  4. Insecure deserialization

Explanation

Building SQL text from untrusted input lets an attacker alter query structure, which is SQL injection. The fix is parameterized queries or prepared statements rather than string concatenation.

Question 4Static Application Security Testing (SAST) Fundamentals and Secure Coding Concepts

Which practice most effectively prevents SQL injection when a query includes user-supplied values?

  1. Escaping single quotes with string replacement
  2. Restricting input length to 32 characters
  3. Hiding detailed database error messages
  4. Using parameterized queries with bound parameters Correct answer.

Explanation

Parameterized queries send values separately from the query structure so input cannot change the SQL syntax. Manual escaping is error-prone and database-specific, and length limits do not remove the injection risk.

Question 5Static Application Security Testing (SAST) Fundamentals and Secure Coding Concepts

What distinguishes SAST from dynamic application security testing (DAST)?

  1. SAST cannot analyze compiled languages
  2. SAST only detects runtime configuration errors
  3. SAST examines source or bytecode without executing the program Correct answer.
  4. SAST requires a running server and crafted HTTP requests

Explanation

SAST analyzes code statically, before or without execution, so it can flag issues in code paths that tests never exercise. DAST instead probes a running application from the outside.

Question 6Static Application Security Testing (SAST) Fundamentals and Secure Coding Concepts

What is a false positive in the context of a SAST scan?

  1. A crash of the scanning engine
  2. A real vulnerability the tool failed to report
  3. A reported finding that is not actually exploitable Correct answer.
  4. A duplicate finding merged by the report

Explanation

A false positive is a finding the tool raises that does not correspond to a real exploitable weakness, often because a sanitizer was not recognized. False negatives, by contrast, are missed real issues.

Question 7Static Application Security Testing (SAST) Fundamentals and Secure Coding Concepts

Which control most directly mitigates cross-site scripting when untrusted data is written into HTML output?

  1. Input length validation
  2. Using POST instead of GET
  3. Context-aware output encoding Correct answer.
  4. Disabling client-side JavaScript

Explanation

Context-aware output encoding converts dangerous characters so untrusted data is treated as text rather than markup or script. The encoding must match the output context, such as HTML body, attribute, or JavaScript.

Question 8Static Application Security Testing (SAST) Fundamentals and Secure Coding Concepts

A SAST finding shows a request parameter flowing into a file-open API where the path is built by concatenation. Which weakness is indicated?

  1. Command injection
  2. Path traversal Correct answer.
  3. XML external entity injection
  4. Open redirect

Explanation

When untrusted input controls a file path, sequences such as ../ can escape the intended directory, which is path traversal. The remediation is to validate against an allowlist or canonicalize and confirm the resolved path stays within the base directory.

Question 9Static Application Security Testing (SAST) Fundamentals and Secure Coding Concepts

Why is blacklist-based input validation generally weaker than allowlist validation for security?

  1. Blacklists cannot be applied to numeric fields
  2. Blacklists must anticipate every dangerous encoding and variant, so they are easily bypassed Correct answer.
  3. Blacklists run slower at runtime
  4. Allowlists cannot be expressed as regular expressions

Explanation

A blacklist only blocks patterns the author thought of, so alternate encodings or unexpected syntax can slip through. An allowlist defines exactly what is acceptable and rejects everything else.

Question 10Static Application Security Testing (SAST) Fundamentals and Secure Coding Concepts

Which statement best describes the role of a sanitizer in taint analysis?

  1. It marks tainted data as safe so propagation stops at that point Correct answer.
  2. It blocks the request at the web server
  3. It reports every sink the data reaches
  4. It converts source code into bytecode

Explanation

A sanitizer is a function or construct the engine recognizes as neutralizing taint, so the data is no longer considered dangerous downstream. Engines rely on models of known sanitizers to avoid false positives.

Question 11Static Application Security Testing (SAST) Fundamentals and Secure Coding Concepts

An application passes user input to a shell command built with string formatting. Which remediation is most robust?

  1. Logging the command before execution
  2. Escaping spaces in the input
  3. Running the process as a low-privilege user
  4. Avoiding the shell and using an API that takes an argument array with no shell interpretation Correct answer.

Explanation

Using an execution API that accepts an argument vector and does not invoke a shell prevents input from being interpreted as command syntax. Escaping is fragile, and privilege reduction only limits impact rather than preventing injection.

Question 12Static Application Security Testing (SAST) Fundamentals and Secure Coding Concepts

What is the main security risk of deserializing untrusted data with a library that reconstructs arbitrary objects?

  1. Reduced logging fidelity
  2. Increased network latency
  3. Loss of data compression
  4. Attacker-controlled object graphs that trigger code execution or logic abuse Correct answer.

Explanation

Insecure deserialization can let an attacker craft a payload that instantiates classes and invokes methods during reconstruction, sometimes achieving remote code execution. The safer approach is to deserialize only simple data formats with strict type allowlists.

Question 13Static Application Security Testing (SAST) Fundamentals and Secure Coding Concepts

A SAST report flags a hardcoded database password in source. Which classification fits best?

  1. Cross-site request forgery
  2. Race condition
  3. Sensitive data exposure through hardcoded secrets Correct answer.
  4. Improper certificate validation

Explanation

Embedding credentials in source exposes secrets to anyone with repository access and to history that persists after removal. Secrets should be supplied through a managed secret store or environment configuration.

Question 14Static Application Security Testing (SAST) Fundamentals and Secure Coding Concepts

Why does a SAST tool often report findings in code that is never reachable in production?

  1. It executes the application during scans
  2. It ignores method calls entirely
  3. It analyzes all code paths statically without runtime reachability information Correct answer.
  4. It only scans configuration files

Explanation

Static analysis examines code as written, including dead or test-only paths, because it lacks runtime context about what actually executes. This contributes to false positives that triage must resolve.

Question 15Static Application Security Testing (SAST) Fundamentals and Secure Coding Concepts

Which coding pattern best mitigates XML external entity (XXE) processing?

  1. Validating the XML against a schema only
  2. Disabling external entity and DTD processing in the parser configuration Correct answer.
  3. Renaming the root element
  4. Compressing the XML payload

Explanation

XXE arises when a parser resolves external entities or DTDs from untrusted XML. Disabling external entity resolution and DTD processing removes the capability the attack depends on.

Question 16Static Application Security Testing (SAST) Fundamentals and Secure Coding Concepts

What does an access control check performed only in the user interface indicate?

  1. A safe deserialization pattern
  2. A missing server-side authorization control, since clients can bypass the UI Correct answer.
  3. A robust server-side authorization model
  4. Proper use of output encoding

Explanation

Client-side checks can be bypassed by crafting requests directly, so authorization must be enforced on the server for every sensitive action. UI hiding is a usability feature, not a security boundary.

Question 17Static Application Security Testing (SAST) Fundamentals and Secure Coding Concepts

A SAST engine reports that a value from a cookie reaches an HTML response. Which detail most affects whether this is exploitable?

  1. Whether the page includes a favicon
  2. Whether the response uses HTTP/2
  3. Whether the cookie uses a long random name
  4. Whether the value is output-encoded for the HTML context before rendering Correct answer.

Explanation

Exploitability depends on whether the tainted value is encoded for the correct output context before being written to the page. Without context-appropriate encoding, an attacker could inject markup or script.

Question 18Static Application Security Testing (SAST) Fundamentals and Secure Coding Concepts

What is the purpose of a baseline scan in a SAST workflow?

  1. To record existing findings so only new issues are gated in future builds Correct answer.
  2. To fuzz the application at runtime
  3. To replace manual code review entirely
  4. To measure server uptime

Explanation

A baseline captures the current set of findings, allowing teams to fail builds only on newly introduced issues while existing debt is addressed over time. This supports incremental adoption of security gates.

Question 19Static Application Security Testing (SAST) Fundamentals and Secure Coding Concepts

A developer builds a redirect target from a request parameter without validation. Which vulnerability results?

  1. Integer overflow
  2. Use-after-free
  3. Buffer overflow
  4. Open redirect Correct answer.

Explanation

Unvalidated redirect targets let attackers send users to malicious sites while the link appears to originate from the trusted application. Restricting targets to an allowlist of known destinations prevents this.

Question 20Static Application Security Testing (SAST) Fundamentals and Secure Coding Concepts

Why can interprocedural analysis reduce false negatives compared with analyzing each function in isolation?

  1. It follows taint across function boundaries where wrappers or helpers may pass data along Correct answer.
  2. It disables sanitizer modeling
  3. It only inspects comments and documentation
  4. It executes each function with test inputs

Explanation

Taint frequently travels through helper functions and wrappers, so analyzing call relationships lets the engine connect a source in one function to a sink in another. Function-local analysis would miss those flows.

Question 21Static Application Security Testing (SAST) Fundamentals and Secure Coding Concepts

An application stores session identifiers in a cookie without the HttpOnly and Secure attributes. Which combination of risks is most relevant?

  1. SQL injection and command injection
  2. Script access to the cookie via XSS and transmission over plaintext channels Correct answer.
  3. Memory leaks and buffer overflows
  4. Race conditions and deadlocks

Explanation

Without HttpOnly, injected script can read the cookie, and without Secure it may be sent over unencrypted connections. Both attributes harden session cookies against theft.

Question 22Static Application Security Testing (SAST) Fundamentals and Secure Coding Concepts

A SAST rule models a custom encoding function as a sanitizer, but the function only escapes characters for HTML attributes. A finding is suppressed when the value is written into a script block. What is the best assessment?

  1. The finding should be ignored because script blocks are not sinks
  2. The suppression is a false negative because the sanitizer is context-mismatched Correct answer.
  3. The encoding function should be removed to satisfy the scanner
  4. The suppression is correct because any encoding neutralizes all contexts

Explanation

Encoding is only safe when it matches the output context; attribute encoding does not protect a JavaScript context. Modeling that function as a general sanitizer hides a real flow, producing a false negative.

Question 23Static Application Security Testing (SAST) Fundamentals and Secure Coding Concepts

A team wants to reduce SAST noise without weakening detection. Which approach is most defensible?

  1. Tune sanitizer and framework models and document approved false-positive suppressions with justification Correct answer.
  2. Disable all rules that produce more than one finding
  3. Suppress every finding in files touched by senior developers
  4. Lower the severity of all findings to informational

Explanation

Accuracy improves when the engine correctly models frameworks and sanitizers and when individual suppressions are reviewed and documented. Blanket disabling or severity downgrades hides real issues instead of resolving them.

Question 24Static Application Security Testing (SAST) Fundamentals and Secure Coding Concepts

A SAST scan finds a tainted value passed to a logging call. Why might this still matter even though logging is not a classic injection sink?

  1. Logging automatically encodes all control characters
  2. Unsanitized input in logs can enable log injection or forged entries and leak sensitive data Correct answer.
  3. Log files are never read by other systems
  4. Logging calls always execute SQL

Explanation

Attacker-controlled data in logs can inject newline characters to forge entries or corrupt log parsing, and may expose sensitive values to those with log access. Treating logs as an output context requiring encoding is the mitigation.

Question 25Checkmarx Platform Architecture, Deployment, and Administration

In a standard Checkmarx CxSAST deployment, which component is responsible for receiving scan requests, distributing them to scan engines, and persisting results to the database?

  1. The CxSAST web portal front-end
  2. The CxAudit desktop client
  3. The source control plugin installed in the IDE
  4. The CxSAST Manager (CxManager) server Correct answer.

Explanation

The CxManager server is the orchestration tier: it accepts scan jobs from the portal, CLI, or plugins, queues them, dispatches work to registered scan engines, and writes results to the SQL database. The portal is only a presentation layer that talks to the manager's API, and CxAudit is an analyst tool for query authoring and result triage.

Question 26Checkmarx Platform Architecture, Deployment, and Administration

A scan engine is installed on a separate host from the CxManager. Which configuration step is required before the manager will dispatch scans to it?

  1. Registering the engine in the manager with its address and a shared credential/secret Correct answer.
  2. Opening only outbound HTTPS from the engine to the portal's public URL
  3. Adding the engine host to the manager's LDAP directory as a service account
  4. Installing CxAudit on the engine host and pointing it at the manager database

Explanation

Scan engines must be registered with the manager so it knows the engine's address and can authenticate to it; the shared secret established at registration is what authorizes job dispatch. Without a successful registration the engine remains unassigned and receives no scan tasks.

Question 27Checkmarx Platform Architecture, Deployment, and Administration

Which database platforms are officially supported as the CxSAST system database in current Checkmarx documentation?

  1. SQLite for small deployments and Oracle for large ones
  2. PostgreSQL and MySQL only
  3. Microsoft SQL Server and Oracle Correct answer.
  4. IBM Db2 and MariaDB

Explanation

Checkmarx documents Microsoft SQL Server and Oracle as the supported back-end databases for CxSAST, and the installation wizard asks which of these to configure. Other relational engines are not certified, so running on them voids supportability.

Question 28Checkmarx Platform Architecture, Deployment, and Administration

An administrator wants scans to start automatically whenever code is pushed to a repository. Which integration pattern accomplishes this with the least manual effort?

  1. Enabling the manager's built-in polling of the repository's default branch every hour
  2. Scheduling a nightly full scan of every project through the portal
  3. Configuring a webhook in the source control system that triggers the Checkmarx CI/CD plugin or REST API to queue a scan Correct answer.
  4. Asking developers to run CxAudit locally before each commit

Explanation

Event-driven scanning is achieved by a source control webhook that calls the Checkmarx plugin or REST API to create a scan on push, giving immediate feedback on the changed code. Scheduled full scans and manual local runs either lag behind the change or depend on developer discipline.

Question 29Checkmarx Platform Architecture, Deployment, and Administration

Which Checkmarx role is scoped so that a user can see and act on results only for the projects to which they are assigned, rather than the whole team?

  1. The CxAudit query editor role
  2. A team-scoped role assigned through team membership Correct answer.
  3. The scan engine service account role
  4. The global system administrator role

Explanation

Access control in CxSAST is built on teams: a user's role is granted within a team, and project visibility follows team assignment. The system administrator is global by design, and query editing or engine service accounts are not project-scoping mechanisms.

Question 30Checkmarx Platform Architecture, Deployment, and Administration

What is the purpose of the CxSAST license file applied during installation and renewal?

  1. It stores the credentials used by scan engines to authenticate to the manager
  2. It holds the TLS certificate presented by the web portal
  3. It contains the CxQL query packs downloaded by each scan
  4. It defines the licensed scan engine count, expiry, and enabled features that the manager enforces Correct answer.

Explanation

The license file governs commercial entitlements such as the number of permitted scan engines, the expiry date, and which product capabilities are enabled; the manager validates it at startup and on renewal. Engine secrets, query packs, and TLS certificates are managed separately.

Question 31Checkmarx Platform Architecture, Deployment, and Administration

An administrator needs to add a second scan engine to handle increased queue volume. Which sequence reflects correct practice?

  1. Install the engine and point it directly at the CxSAST database so it can write results
  2. Install the engine and add its hostname to the portal's trusted sites list
  3. Install the engine, register it with the manager using the shared secret, verify its status is active, then confirm it receives jobs Correct answer.
  4. Install the engine and restart the manager's database service to force rebalancing

Explanation

Scaling out means installing the engine software, registering it against the manager with the shared secret, and confirming the manager reports it as active before expecting jobs to be dispatched. Engines never write to the database directly; all persistence flows through the manager.

Question 32Checkmarx Platform Architecture, Deployment, and Administration

Which protocol and port does a typical CxSAST scan engine use to communicate with the CxManager service?

  1. LDAP over TCP 389 to the domain controller
  2. HTTPS over TCP 443 to the manager Correct answer.
  3. SMB over TCP 445 to the file share
  4. SNMP over UDP 161 to the monitoring host

Explanation

Engine-to-manager traffic is carried over HTTPS, normally on TCP 443, and must be permitted in both directions between the engine host and the manager. Directory, file-sharing, and monitoring protocols serve unrelated functions in the deployment.

Question 33Checkmarx Platform Architecture, Deployment, and Administration

Where are the CxSAST scan results and project metadata primarily persisted?

  1. In the CxSAST system database configured during installation Correct answer.
  2. In the CxAudit user's roaming profile
  3. In the source control repository as commit comments
  4. In flat XML files written to each scan engine's local disk

Explanation

Projects, scans, and findings are stored in the configured SQL Server or Oracle database, which is why database backups are central to disaster recovery. Engines hold only transient working data, and nothing is written back to source control.

Question 34Checkmarx Platform Architecture, Deployment, and Administration

What is the recommended approach for backing up a CxSAST deployment so it can be restored consistently?

  1. Back up the system database and the manager's configuration and application files together Correct answer.
  2. Back up only the scan engines' local working directories
  3. Back up only the web portal's static content directory
  4. Back up the CxAudit installation folder on each analyst workstation

Explanation

A restorable backup pairs the system database, which holds projects and findings, with the manager's configuration and application files that define teams, settings, and integrations. Backing up engines, portal static content, or analyst workstations captures none of the authoritative state.

Question 35Checkmarx Platform Architecture, Deployment, and Administration

Which statement correctly describes the relationship between a Checkmarx project and its scans?

  1. A project can hold exactly one scan, after which it must be recreated
  2. A project is a container for a codebase, and each scan of that project produces a result set that can be compared to prior scans Correct answer.
  3. A project stores only the latest scan and discards history immediately
  4. Each scan creates a new project automatically and projects cannot be reused

Explanation

Projects group a codebase and its configuration, and repeated scans of the same project build a history that supports trend reporting and comparison against a baseline. This is why incremental and scheduled scans target an existing project rather than creating new ones.

Question 36Checkmarx Platform Architecture, Deployment, and Administration

An administrator must ensure scan engines can reach the manager across a firewall. Which connectivity requirement is correct?

  1. Only the engine needs outbound access; the manager never initiates connections
  2. Only the manager needs outbound access; engines never accept connections
  3. The engine must be able to initiate connections to the manager, and the manager must be able to reach the engine Correct answer.
  4. No connectivity is needed if both hosts share the same database

Explanation

Job dispatch and status reporting require bidirectional communication between manager and engine, so firewall rules must allow traffic in both directions on the service port. Sharing a database does not substitute for manager-engine communication.

Question 37Checkmarx Platform Architecture, Deployment, and Administration

Which built-in mechanism lets a CxSAST administrator run scans on a recurring basis without external scheduling tools?

  1. Windows Task Scheduler jobs created by the installer
  2. Cron entries placed on each scan engine host
  3. The CxAudit batch query runner
  4. Scheduled scans configured on the project in the CxSAST portal Correct answer.

Explanation

The portal exposes scan scheduling per project, letting administrators define recurrence and scan settings that the manager enforces. OS-level schedulers and CxAudit are not the supported scheduling mechanism for project scans.

Question 38Checkmarx Platform Architecture, Deployment, and Administration

A team reports they cannot see a newly created project in the portal. What is the most likely administrative cause?

  1. The users have not installed CxAudit
  2. The license has fewer engines than projects
  3. The scan engine hosting the project is offline
  4. The project was not assigned to a team the users belong to Correct answer.

Explanation

Project visibility is governed by team assignment; if a project belongs to a team the user is not a member of, it does not appear regardless of engine health. Engine availability and client tooling do not control portal visibility.

Question 39Checkmarx Platform Architecture, Deployment, and Administration

What does the CxSAST installation wizard require in order to configure the system database?

  1. Connection details and credentials for a pre-created SQL Server or Oracle database Correct answer.
  2. A PostgreSQL superuser password generated by the wizard
  3. An embedded database file path on the manager host
  4. A cloud object storage bucket and access key

Explanation

The wizard expects an existing supported database and the connection information and credentials needed to create or populate the CxSAST schema. It does not provision PostgreSQL, an embedded file database, or object storage as the system store.

Question 40Checkmarx Platform Architecture, Deployment, and Administration

Which activity belongs to the CxSAST administrator rather than to a security analyst using CxAudit?

  1. Writing custom CxQL queries to detect a new vulnerability pattern
  2. Managing teams, users, and role assignments in the portal Correct answer.
  3. Triaging false positives in a scan's result set
  4. Marking a finding as a confirmed exploit

Explanation

User, team, and role administration is a platform administration duty performed in the portal. Query authoring and result triage are analyst responsibilities carried out in CxAudit or the result viewer.

Question 41Checkmarx Platform Architecture, Deployment, and Administration

An organization must keep all source code and scan data inside its own network. Which deployment consideration satisfies this?

  1. Store only the database on-premises while sending source to a public endpoint
  2. Rely on the vendor's shared multi-tenant scanning service for all projects
  3. Disable the license check so no external calls occur
  4. Host the manager, engines, and database on-premises or in a private environment under organizational control Correct answer.

Explanation

Data residency is met by deploying the manager, scan engines, and database within infrastructure the organization controls, so source and results never leave the network. Sending source to a shared service or a public endpoint defeats the requirement, and license enforcement is unrelated to data location.

Question 42Checkmarx Platform Architecture, Deployment, and Administration

What is the effect of increasing the number of registered scan engines without changing the license?

  1. Each extra engine silently shares a license seat with an existing one
  2. The database expands its schema to accommodate the extra engines
  3. Additional engines beyond the licensed count are not permitted and will not be usable Correct answer.
  4. The manager automatically upgrades the license to match the engine count

Explanation

The license caps how many scan engines may run, and the manager enforces that entitlement, so adding engines beyond the licensed number does not yield extra capacity. Licenses are not auto-upgraded, and engine count has no bearing on database schema.

Question 43Checkmarx Platform Architecture, Deployment, and Administration

Which log or console should an administrator check first when scans remain queued and never start on a registered engine?

  1. The CxAudit query execution log
  2. The source control server's audit trail
  3. The web browser's developer console on the analyst workstation
  4. The manager's scan job and engine communication logs Correct answer.

Explanation

Queue stalls point to the manager's job scheduling and its communication with engines, so the manager logs are the primary diagnostic source. Browser consoles, CxAudit logs, and source control audits do not record engine dispatch decisions.

Question 44Checkmarx Platform Architecture, Deployment, and Administration

How does CxSAST typically authenticate enterprise users so that accounts and group membership are centrally managed?

  1. By storing passwords in the CxAudit query repository
  2. By issuing each user a scan engine shared secret
  3. By integrating with an LDAP or Active Directory directory service Correct answer.
  4. By relying on the database's built-in SQL logins for portal access

Explanation

CxSAST supports directory integration so users authenticate against LDAP or Active Directory and group membership can drive team and role mapping. Query repositories, engine secrets, and SQL logins are not user authentication mechanisms for the portal.

Question 45Checkmarx Platform Architecture, Deployment, and Administration

A scan completes but reports no findings for a language the team knows is present in the codebase. Which administrative check is most relevant?

  1. Verify the analyst has CxAudit installed on their workstation
  2. Confirm the project's scan configuration includes the relevant language and that the packaged query set covers it Correct answer.
  3. Increase the number of scan engines to speed up the scan
  4. Re-run the license activation to refresh entitlements

Explanation

Missing findings for a known language usually trace to scan configuration or query coverage rather than capacity, so verifying language support and the applied query set is the right first check. Engine count, analyst tooling, and license reactivation do not change what a scan analyzes.

Question 46Checkmarx Platform Architecture, Deployment, and Administration

Which practice best protects the CxSAST deployment's administrative interfaces in production?

  1. Restrict network access to the manager and portal, use TLS, and grant administrative roles only to required accounts Correct answer.
  2. Disable logging on the manager to reduce disk usage
  3. Publish the portal directly to the internet with default administrator credentials
  4. Share a single administrator account among the whole operations team

Explanation

Hardening means limiting who can reach the manager and portal, encrypting traffic with TLS, and applying least privilege to administrative roles. Default credentials, shared accounts, and disabled logging all undermine accountability and security.

Question 47Checkmarx Platform Architecture, Deployment, and Administration

An administrator is planning a high-availability design for CxSAST. Which statement reflects a sound approach?

  1. Put the database on the same disk as the engine workspace to reduce latency
  2. Run two independent managers against separate databases and reconcile results manually
  3. Protect the system database with clustering or replication and place multiple engines behind the manager for scan capacity Correct answer.
  4. Rely on a single manager and single engine, since scans can always be rerun

Explanation

Availability centers on the database, which is the single source of truth, plus enough registered engines to absorb scan demand if one fails. Split managers with divergent databases create irreconcilable state, and co-locating the database with transient engine workspace adds risk without solving availability.

Question 48Checkmarx Platform Architecture, Deployment, and Administration

What is the primary function of the CxSAST web portal in the platform architecture?

  1. It hosts the CxQL query engine that executes during scans
  2. It performs the static code analysis and stores the resulting findings
  3. It provides the browser-based interface for managing projects, users, and viewing scan results through the manager's services Correct answer.
  4. It brokers authentication between scan engines and the database

Explanation

The portal is the presentation tier: administrators and users manage projects, teams, and settings and review results, with all actions served by the manager. Analysis, query execution, and engine-database brokering happen elsewhere in the stack.

Question 49Checkmarx Platform Architecture, Deployment, and Administration

Which statement about upgrading a CxSAST deployment is correct?

  1. The system database should be backed up and the upgrade applied following the documented component order, with engines and manager kept version-compatible Correct answer.
  2. Upgrades require deleting all projects so the schema can be recreated
  3. The database is upgraded automatically by each engine as it connects
  4. Engines can run any version independently of the manager without issue

Explanation

Upgrades require a database backup and adherence to the documented sequence so schema migrations and component versions stay compatible; mixed manager and engine versions are unsupported. Engines never migrate the database, and existing projects are preserved across upgrades.

Question 50Checkmarx Platform Architecture, Deployment, and Administration

In a CxSAST deployment, which component is responsible for coordinating scan jobs and distributing them to registered scan engines?

  1. The source control server
  2. The CxManager service Correct answer.
  3. The CxSAST web portal front end
  4. The CxAudit desktop client

Explanation

CxManager is the central service that owns job orchestration, engine registration and queue management in a CxSAST deployment. Scan engines poll the manager for work, so the manager decides which engine receives which scan. The portal and CxAudit are clients that submit or review work rather than schedule it.