You are configuring Checkmarx for a .NET application. The scan results consistently miss vulnerabilities in a third-party DLL. What is the most likely reason?
Trap 1: The vulnerability is a logic error that static analysis cannot find.
While possible, the most likely cause for missing a *known* DLL vulnerability is configuration/access.
Trap 2: The .NET framework version is set incorrectly in the project…
This would cause compilation errors, not missing vulnerabilities.
Trap 3: The scan engine is set to 'Quick Scan' mode.
Quick scan reduces performance but usually maintains rule coverage.
- A
The vulnerability is a logic error that static analysis cannot find.
Why wrong: While possible, the most likely cause for missing a *known* DLL vulnerability is configuration/access.
- B
The .NET framework version is set incorrectly in the project settings.
Why wrong: This would cause compilation errors, not missing vulnerabilities.
- C
The scan engine is set to 'Quick Scan' mode.
Why wrong: Quick scan reduces performance but usually maintains rule coverage.
- D
The third-party DLL is not configured as a source project or included in the scan scope.
SAST tools need access to code or dependencies to perform data flow analysis.
- E
null
Why wrong: null