Learn the vocabulary of scanning a project's dependency tree for a known vulnerability.
0 / 5 completed
1 / 5
At standup, a dev mentions scanning the project's full dependency tree to identify every open-source library in use and flag one with a known published vulnerability. What is this practice called?
Software composition analysis, or SCA, scans a project's full dependency tree to identify every open-source library actually in use, including an indirect, transitive dependency, and flags one with a known published vulnerability. Manually reading every dependency's source code doesn't scale to a modern project's often deep and wide dependency tree. Automated SCA scanning is what makes it practical to keep track of vulnerability exposure across a large, evolving set of third-party code.
2 / 5
During a design review, the team wants the scan to flag a vulnerability specifically in a transitive dependency, one pulled in indirectly by a direct dependency, not just in a package listed directly in the project's manifest. Which capability supports this?
Full dependency tree resolution scans every transitive dependency, one pulled in indirectly through a direct dependency, not just the packages a project's manifest lists directly. Scanning only the directly listed packages misses a vulnerability buried several layers deep, which is often where a real-world exposure actually lives. This full-tree resolution is essential since most of a modern project's total dependency count typically comes from transitive dependencies, not direct ones.
3 / 5
In a code review, a dev notices the scan report includes each flagged vulnerability's known exploitability and whether the vulnerable code path is actually reachable from the application's own code. What does this represent?
Reachability analysis checks whether the vulnerable code path in a flagged dependency is actually reachable from the application's own code, helping the team prioritize a genuinely exploitable vulnerability over one that exists in a library but is never actually exercised in this specific project. Treating every flagged vulnerability as equally urgent wastes limited remediation effort on a low-risk finding. This prioritization is what makes SCA's often large volume of findings actually actionable.
4 / 5
An incident report shows a known-vulnerable transitive dependency sat unpatched in production for months because the SCA scan only ran manually, and no one had triggered it since the last release. What practice would prevent this?
Running the SCA scan automatically on a recurring schedule and on every dependency change catches a newly disclosed vulnerability in an existing dependency, since a vulnerability can be published well after that dependency was first added. Relying on a scan that only runs when manually triggered leaves a long gap where a new vulnerability goes completely unnoticed. This automated, recurring scanning is what keeps a project's vulnerability picture actually current rather than a stale snapshot from its last release.
5 / 5
During a PR review, a teammate asks why the team runs automated SCA scans instead of just trusting that a well-known open-source library is safe to use without checking. What is the reasoning?
A well-known library can still have a new vulnerability disclosed at any time after a project first adopted it, and that exposure can also hide several layers deep in a transitive dependency no one is directly watching. An automated scan catches this across the full dependency tree on an ongoing basis. The tradeoff is the need to triage a real volume of findings, prioritizing an actually reachable, exploitable vulnerability over a low-risk one.
What does the "Software Composition Analysis Vocabulary" vocabulary exercise cover?
This exercise tests real IT vocabulary related to software composition analysis vocabulary through 5 multiple-choice questions, each built from realistic workplace sentences rather than abstract definitions.
Is this vocabulary exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is completely free — no account, sign-up, or payment required.
How many questions does this exercise have?
This exercise has 5 questions. Each one shows a real-world sentence or scenario with multiple-choice options and an explanation once you answer.
What happens after I answer a question?
You'll see immediate feedback showing whether your answer was correct, along with a short explanation of why — then a button to move to the next question, and a full results screen at the end.
Can I retry the exercise if I get questions wrong?
Yes. Once you reach the results screen, click "Try again" to reset your answers and go through the exercise from the start as many times as you like.
Do I need to create an account to take this exercise?
No account is needed. Your answers are scored in your browser during the session — nothing is saved to a server, so you can jump straight in.
Is my progress saved if I leave the page?
No — progress within an exercise resets if you navigate away or reload. Each exercise is short enough to complete in a few minutes in one sitting.
Are these vocabulary exercises connected to other topics?
Yes — this module shares real-world context with 14 other vocabulary modules. See "Related vocabulary" below to keep building a connected skill set.
How is this different from reading a glossary or blog article?
Exercises like this one are active recall drills — you have to choose the correct term or phrasing yourself, which builds retention faster than passively reading a definition.
Where can I find more vocabulary exercises?
Browse the full Vocabulary exercises hub for hundreds of modules covering Agile, DevOps, security, databases, architecture, and more — organised by IT role and skill.