I85PREP
⌘ K
Checkmarx CxCE study materials
Checkmarx CxCE study resources

Checkmarx CxCE: Scan Configuration: Projects, Presets, Queries, and Scan Scheduling

Checkmarx CxCE · Work through your exam, one topic at a time.

All guide sections

Scan Configuration: Projects, Presets, Queries, and Scan Scheduling

What this domain tests

Whether you can configure a project so it scans the right code with the right rule set, at the right time, and understand what each setting silently includes or excludes.

Projects and source

A project is the container for scans and belongs to a team. Its source location may be a local/shared folder or a supported source-control repository (Git, SVN, TFS, Perforce). The account running the scan must be able to read that location. The scan configuration also controls which file extensions are analyzed, which folders or patterns are excluded, and the source encoding.

Presets and query groups

A preset is a named selection of query groups at chosen severities; it determines which queries actually run. Built-in presets cover the default rule set, all queries, and compliance framings such as OWASP Top 10 or PCI DSS. Custom queries are only active if their query group is included in a preset used by the project. Because presets are shared, editing one changes every project that references it.

Scan type and schedule

A full scan analyzes the whole codebase. An incremental scan analyzes only files changed since the previous scan, which is faster but depends on the scan chain, and results can be missed after large refactors, renames, or branch switches. Scheduling supports recurring runs (daily, weekly, monthly) plus one-off scans, typically outside working hours; scheduled runs use the service account, not the person who configured them.

Worked example

A team wants OWASP Top 10 coverage plus its own rule banning Runtime.exec. Start from the OWASP preset, then build a custom preset that adds the custom query's group, and attach that preset to the project - do not edit the built-in OWASP preset, which would change every other project. Then check the file-extension list: if the new module is Kotlin and .kt is not included, the custom rule will never fire on it.

Traps that cost marks

  • Adding a custom query but never adding its group to the active preset.
  • Editing a shared preset instead of creating a project-specific one.
  • Relying on incremental scans indefinitely; schedule periodic full scans.
  • Excluding test or generated folders without knowing which production code lives there.
  • Forgetting encoding: mis-decoded sources distort both results and line numbers.