Dependency Vulnerability Communication — Vocabulary
Learn vocabulary for communicating dependency vulnerabilities: CVE triage, severity scoring, and remediation timelines.
0 / 10 completed
1 / 10
What is a 'CVE triage' process in supply chain security vocabulary?
CVE triage: step 1: does your software use the vulnerable component? (SBOM helps here). Step 2: are you using the vulnerable version? Step 3: is the vulnerable code path reachable in your deployment? (reachability analysis). Step 4: what is the actual exploitability in your context? Step 5: remediation priority based on real risk, not just CVSS score.
2 / 10
What is 'reachability analysis' in dependency vulnerability vocabulary?
Reachability analysis: a critical dependency with a critical CVE might not actually be exploitable in your context if your code never calls the vulnerable function. Tools (Snyk, Endor Labs, Semgrep Supply Chain) perform reachability analysis to reduce alert noise — flagging only vulnerabilities where the vulnerable code path is actually exercised.
3 / 10
What is the 'mean time to remediate' (MTTR) metric in vulnerability management?
Vulnerability MTTR: from disclosure (or detection in your environment) to fix deployed in production. Industry benchmarks: Critical CVEs should be remediated within 24-72 hours. High: 7-30 days. Medium: 30-90 days. Tracking MTTR reveals whether your vulnerability management process is effective — long MTTR signals process or resource gaps.
4 / 10
What is a 'false positive' in dependency vulnerability scanning vocabulary?
False positives are a major challenge in dependency scanning: a tool reports 50 critical vulnerabilities, but 40 of them are in test-only dependencies, 5 are in unreachable code paths, and 3 are in components not included in production builds. Reachability analysis and context-aware scanning reduce false positives and prevent alert fatigue.
5 / 10
What is 'virtual patching' in dependency vulnerability vocabulary?
Virtual patching: if updating a critical library is complex and risky (may break the application), a WAF rule or security control can block the specific attack vector while the proper fix is developed and tested. Virtual patching reduces the risk window but is not a permanent solution — it must be tracked and the underlying dependency must still be updated.
6 / 10
Sarah from the Security team sent this Slack message to the team: 'We've identified a critical vulnerability in our Spring Boot project – CVE-2023-1234. It's affecting transitive dependencies. Should we immediately block all deployments until a fix is confirmed?' What does 'transitive dependencies' most accurately refer to in this context?
'Transitive dependencies' are third-party libraries that your project relies on. These libraries *themselves* may depend on other components – this creates a chain of vulnerabilities. Understanding this relationship is crucial for effective vulnerability management and prioritization. A false positive alert might be triggered by a vulnerability in a dependency, but it's the *transitive* nature of the problem that needs addressing.
7 / 10
You're reviewing a Pull Request for a new feature in your Python application. The developer has included this comment: 'I've updated the requests library to version 2.31.0 to address CVE-2024-5678. This should mitigate the risk of remote code execution vulnerabilities.' Which statement BEST describes what the developer is attempting to achieve?
The developer is employing 'virtual patching,' which involves applying fixes to vulnerable dependencies without immediately updating the core application code. This is a common strategy for quickly addressing critical vulnerabilities while minimizing disruption. The update to requests version 2.31.0 specifically targets CVE-2024-5678, demonstrating focused mitigation.
8 / 10
During a daily standup meeting, you're discussing progress on a project. A developer says: 'I've run the dependency scan tool and it flagged several high-severity vulnerabilities in our Node.js application. We need to investigate these immediately.' What is the *primary* purpose of running this 'dependency scan tool'?
A dependency scan tool is specifically designed to detect vulnerabilities within the dependencies of a software project. It analyzes these components against known vulnerability databases (like the National Vulnerability Database – NVD) to pinpoint outdated or insecure libraries. The goal is proactive risk management – identifying and addressing issues before they are exploited.
9 / 10
You're reviewing the description for a Pull Request introducing a new microservice. The developer includes this text: 'This service utilizes the Jackson library version 2.15.0 to handle JSON serialization and deserialization. We have configured it with strict security policies to prevent injection attacks.' What does 'strict security policies' most likely refer to in this scenario?
'Strict security policies' in this context refers to configuring the Jackson library – and potentially the microservice itself – with specific settings that limit its functionality and reduce potential vulnerabilities. This could involve disabling certain features or restricting the types of data it can handle, mitigating risks associated with JSON injection attacks.
10 / 10
A team lead asks you to explain the difference between a 'false positive' and a 'true positive' in the context of vulnerability scanning. You respond: 'A true positive means we actually have a problem that needs fixing, while a false positive is just… well, it's not.' Which statement BEST completes this explanation?
A 'false positive' occurs when the vulnerability scanner incorrectly flags a dependency or code element as vulnerable. This often happens due to outdated vulnerability databases, misconfigured rules, or the scanner failing to account for specific context within the application. A 'true positive' represents an *actual* vulnerability requiring attention and remediation.
What will I learn from the "Dependency Vulnerability Communication — Vocabulary" exercise?
Learn vocabulary for communicating dependency vulnerabilities: CVE triage, severity scoring, and remediation timelines.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall required.
How many questions are in this exercise?
This set contains 10 multiple-choice questions, each with a detailed explanation shown after you answer.
Do I need to create an account to track my progress?
No account is required. Your progress bar and score reset each time you reload the page, but you can retry the exercise as many times as you like.
Who is this Supply Chain Security exercise for?
This exercise is built for IT professionals and non-native English speakers who need to read, write, and discuss supply chain security topics confidently at work.
What happens if I answer a question incorrectly?
You will see the correct answer highlighted along with a detailed explanation of why it is correct -- so every wrong answer becomes a learning moment, not just a lost point.
Can I retry this exercise?
Yes -- click "Try again" on the results screen at any time to reset your score and go through all the questions again.
How long does this exercise take to complete?
Most learners finish all 10 questions in under 10 minutes, since each question is answered by clicking a single option.
Where can I find more Supply Chain Security exercises?
See the full Supply Chain Security exercises hub for more vocabulary drills on this topic.
Is this exercise mobile-friendly?
Yes -- the exercise works on any device with a modern browser, including phones and tablets, with no app download required.