Start Lesson 2 Knowledge Check

As we scan through the file, we sort through the contents looking for known component extension. We collect hashes as unique identifiers, and then we open them up and we collect hashes of their contents. These identifiers compile together into an XML package.

Match the policy type to the corresponding fact.

In an “Other” policy type, what are the types of matches that are identified by the hash algorithm? (Select all that apply).

As Sonatype scans through the file, we sort through the contents looking for known component extension. We collect hashes as unique identifiers, and then we open them up and we collect hashes of their contents. These identifiers compile together into an XML package.

An example of an obligation of this type of policy would be a requirement to include a copyright attribution.

These are reported to the community and the National Vulnerability Database. From that, a Common Vulnerabilities and Exposures (CVE) identifier is created with a description of the vulnerability and the component that it implicates.

This type of policy may enforce things like finding a test component within your production build. If that were to happen, the component should have already been removed since test components may have vulnerabilities that expose your application to unnecessary risk.