AZ400-Q: triage a dependency alert
Dependabot reports a high-severity vulnerability in a transitive dependency. A developer proposes automatically blocking every deployment immediately. What should the security plan do first?
- A) Ignore transitive dependencies because the team did not write them.
- B) Assess exposure, reachability, severity, available remediation, and business impact; then apply the documented gate/exception policy. ✓
- C) Delete the lock file and let the next build pick any versions.
- D) Treat the alert as proof of compromise and rotate every credential.
Answer: B. Alerts are important signals, but a defensible response uses a documented risk decision and remediation path. Policy may then block release at the agreed threshold.
Why not the others: Transitive components can be exploitable. Uncontrolled version changes damage reproducibility. A vulnerability alert is not automatically a credential leak.
Related
dependabot-alerts · dependency-vulnerabilities · compliance-gate