SONAR-SEC Practice Test

SONAR-SEC practice test: what's covered

• Quality Gates
• Quality Profiles
• Security Hotspots
• New Code
• CI
• Pull Requests

Free SONAR-SEC sample questions

1. A security engineer needs to block a pull request that introduces critical issues during a controlled production rollout. Which response is the BEST fit?

   • A. apply a quality gate to new code and require the PR check to pass before merge — with change evidence recorded
   • B. measure only overall legacy debt and ignore new-code conditions — with change evidence recorded
   • C. turn off pull-request decoration — with change evidence recorded
   • D. approve the merge when analysis has not completed — with change evidence recorded
   Show answer

   Correct: A. apply a quality gate to new code and require the PR check to pass before merge — with change evidence recorded is the best answer because new-code gates prevent fresh defects without requiring immediate legacy cleanup. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes quality-gate result, PR decoration, and failing condition.

2. An administrator must block a pull request that introduces critical issues while investigating an urgent support case. Which action should be taken first?

   • A. apply a quality gate to new code and require the PR check to pass before merge — after confirming scope and ownership
   • B. measure only overall legacy debt and ignore new-code conditions — after confirming scope and ownership
   • C. turn off pull-request decoration — after confirming scope and ownership
   • D. approve the merge when analysis has not completed — after confirming scope and ownership
   Show answer

   Correct: A. apply a quality gate to new code and require the PR check to pass before merge — after confirming scope and ownership is the best answer because new-code gates prevent fresh defects without requiring immediate legacy cleanup. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes quality-gate result, PR decoration, and failing condition.

3. A company plans to block a pull request that introduces critical issues during an audit-readiness review. Which design best meets the requirement?

   • A. apply a quality gate to new code and require the PR check to pass before merge — using the vendor-supported workflow
   • B. measure only overall legacy debt and ignore new-code conditions — using the vendor-supported workflow
   • C. turn off pull-request decoration — using the vendor-supported workflow
   • D. approve the merge when analysis has not completed — using the vendor-supported workflow
   Show answer

   Correct: A. apply a quality gate to new code and require the PR check to pass before merge — using the vendor-supported workflow is the best answer because new-code gates prevent fresh defects without requiring immediate legacy cleanup. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes quality-gate result, PR decoration, and failing condition.

4. During troubleshooting, the team must block a pull request that introduces critical issues after a regional service change. Which next step is most defensible?

   • A. apply a quality gate to new code and require the PR check to pass before merge — with least privilege preserved
   • B. measure only overall legacy debt and ignore new-code conditions — with least privilege preserved
   • C. turn off pull-request decoration — with least privilege preserved
   • D. approve the merge when analysis has not completed — with least privilege preserved
   Show answer

   Correct: A. apply a quality gate to new code and require the PR check to pass before merge — with least privilege preserved is the best answer because new-code gates prevent fresh defects without requiring immediate legacy cleanup. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes quality-gate result, PR decoration, and failing condition.

5. An administrator needs to block a pull request that introduces critical issues before approving a high-risk release. Which TWO actions provide the strongest implementation and verification? (Choose TWO)

   • A. apply a quality gate to new code and require the PR check to pass before merge — with monitoring and rollback defined
   • B. verify the result using quality-gate result, PR decoration, and failing condition — with monitoring and rollback defined
   • C. measure only overall legacy debt and ignore new-code conditions — with monitoring and rollback defined
   • D. turn off pull-request decoration — with monitoring and rollback defined
   • E. approve the merge when analysis has not completed — with monitoring and rollback defined
   Show answer

   Correct: A and B. apply a quality gate to new code and require the PR check to pass before merge — with monitoring and rollback defined and verify the result using quality-gate result, PR decoration, and failing condition — with monitoring and rollback defined are correct because new-code gates prevent fresh defects without requiring immediate legacy cleanup. The other options are not appropriate: they weaken scope, skip a required control, or do not provide reliable evidence for this SonarQube Security & Quality scenario.

Last updated: 2026-10-19

SONAR-SEC practice test FAQ