GH-500 · Question #43
What classification is used to categorize Dependabot alerts? Each correct answer presents part of the solution. (Choose three.)
The correct answer is C. Common Vulnerabilities and Exposures (CVE) D. Common Weakness Enumeration (CWE) E. Exploit Prediction Scoring System (EPSS). Dependabot alerts are categorized using three industry-standard classification systems: CVE (Common Vulnerabilities and Exposures, C) provides a unique identifier for each publicly known vulnerability; CWE (Common Weakness Enumeration, D) categorizes the type of software…
Question
What classification is used to categorize Dependabot alerts? Each correct answer presents part of the solution. (Choose three.)
Options
- AGitHub Security Advisory ID (GHSA)
- BStatic Application Security Testing (SAST)
- CCommon Vulnerabilities and Exposures (CVE)
- DCommon Weakness Enumeration (CWE)
- EExploit Prediction Scoring System (EPSS)
How the community answered
(31 responses)- A10% (3)
- B16% (5)
- C74% (23)
Explanation
Dependabot alerts are categorized using three industry-standard classification systems: CVE (Common Vulnerabilities and Exposures, C) provides a unique identifier for each publicly known vulnerability; CWE (Common Weakness Enumeration, D) categorizes the type of software weakness (e.g., SQL injection, buffer overflow) underlying the vulnerability; and EPSS (Exploit Prediction Scoring System, E) provides a probability score estimating how likely a vulnerability is to be exploited in the wild. GHSA (A) is GitHub's own Security Advisory identifier and is a source/reference for advisories rather than one of the three standard classifications used to categorize Dependabot alerts. SAST (B) is a security testing methodology, not a classification system for vulnerabilities.
Topics
Community Discussion
No community discussion yet for this question.