SNYK-DEVSEC Practice Test

SNYK-DEVSEC practice test: what's covered

• Snyk Code
• Open Source
• Container
• IaC
• Fix PRs
• Policy
• CI/CD

Free SNYK-DEVSEC sample questions

1. A security engineer needs to identify vulnerable transitive packages before a release during a controlled production rollout. Which response is the BEST fit?

   • A. run an Open Source test against the manifest and lockfile and review the dependency path — with change evidence recorded
   • B. scan only the compiled application binary with an IaC policy — with change evidence recorded
   • C. remove the lockfile so dependency resolution is less restrictive — with change evidence recorded
   • D. ignore every transitive finding because it is not directly declared — with change evidence recorded
   Show answer

   Correct: A. run an Open Source test against the manifest and lockfile and review the dependency path — with change evidence recorded is the best answer because the dependency graph and lockfile reveal vulnerable direct and transitive paths. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes dependency path, fix version, exploit maturity, and project policy.

2. An administrator must identify vulnerable transitive packages before a release while investigating an urgent support case. Which action should be taken first?

   • A. run an Open Source test against the manifest and lockfile and review the dependency path — after confirming scope and ownership
   • B. scan only the compiled application binary with an IaC policy — after confirming scope and ownership
   • C. remove the lockfile so dependency resolution is less restrictive — after confirming scope and ownership
   • D. ignore every transitive finding because it is not directly declared — after confirming scope and ownership
   Show answer

   Correct: A. run an Open Source test against the manifest and lockfile and review the dependency path — after confirming scope and ownership is the best answer because the dependency graph and lockfile reveal vulnerable direct and transitive paths. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes dependency path, fix version, exploit maturity, and project policy.

3. A company plans to identify vulnerable transitive packages before a release during an audit-readiness review. Which design best meets the requirement?

   • A. run an Open Source test against the manifest and lockfile and review the dependency path — using the vendor-supported workflow
   • B. scan only the compiled application binary with an IaC policy — using the vendor-supported workflow
   • C. remove the lockfile so dependency resolution is less restrictive — using the vendor-supported workflow
   • D. ignore every transitive finding because it is not directly declared — using the vendor-supported workflow
   Show answer

   Correct: A. run an Open Source test against the manifest and lockfile and review the dependency path — using the vendor-supported workflow is the best answer because the dependency graph and lockfile reveal vulnerable direct and transitive paths. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes dependency path, fix version, exploit maturity, and project policy.

4. During troubleshooting, the team must identify vulnerable transitive packages before a release after a regional service change. Which next step is most defensible?

   • A. run an Open Source test against the manifest and lockfile and review the dependency path — with least privilege preserved
   • B. scan only the compiled application binary with an IaC policy — with least privilege preserved
   • C. remove the lockfile so dependency resolution is less restrictive — with least privilege preserved
   • D. ignore every transitive finding because it is not directly declared — with least privilege preserved
   Show answer

   Correct: A. run an Open Source test against the manifest and lockfile and review the dependency path — with least privilege preserved is the best answer because the dependency graph and lockfile reveal vulnerable direct and transitive paths. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes dependency path, fix version, exploit maturity, and project policy.

5. An administrator needs to identify vulnerable transitive packages before a release before approving a high-risk release. Which TWO actions provide the strongest implementation and verification? (Choose TWO)

   • A. run an Open Source test against the manifest and lockfile and review the dependency path — with monitoring and rollback defined
   • B. verify the result using dependency path, fix version, exploit maturity, and project policy — with monitoring and rollback defined
   • C. scan only the compiled application binary with an IaC policy — with monitoring and rollback defined
   • D. remove the lockfile so dependency resolution is less restrictive — with monitoring and rollback defined
   • E. ignore every transitive finding because it is not directly declared — with monitoring and rollback defined
   Show answer

   Correct: A and B. run an Open Source test against the manifest and lockfile and review the dependency path — with monitoring and rollback defined and verify the result using dependency path, fix version, exploit maturity, and project policy — with monitoring and rollback defined are correct because the dependency graph and lockfile reveal vulnerable direct and transitive paths. The other options are not appropriate: they weaken scope, skip a required control, or do not provide reliable evidence for this Snyk Developer Security scenario.

Last updated: 2026-10-19

SNYK-DEVSEC practice test FAQ