For Teachers · Back to the Module · Print with your browser's Print command.

A7 Worksheet: Security Testing in Agile Teams and CI

Student Worksheet (about 25 minutes, Applied level)

Name: ______________________ Class: __________ Date: __________

Read first: A2

Learning Objectives

• [ ] Explain why security checks move earlier and run more often in agile teams.
• [ ] Use a baseline and exit codes to fail a build only on new problems.
• [ ] Read SARIF output in a code review tool.

Key Terms

Write each definition in your own words.

• Shift Left: ______________________________________________
• Regression Testing: ______________________________________________
• Baseline: ______________________________________________
• SARIF: ______________________________________________

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo vulnerable --out a7a and openvapt demo hardened --out a7b, then openvapt diff a7a/report.json a7b/report.json.
2. Run: openvapt demo vulnerable --fail-on critical --out a7c; echo $? and explain the exit code.

Self-Check Questions

1. What does shifting left mean?

• [ ] a) Moving servers to another data centre
• [ ] b) Testing earlier in development, close to each change
• [ ] c) Running tests only before release
• [ ] d) Writing code from left to right

1. What is a regression?

• [ ] a) A new feature
• [ ] b) Something that worked and broke again
• [ ] c) A slow test
• [ ] d) An old report

1. Which exit code means findings reached the --fail-on severity?

• [ ] a) 0
• [ ] b) 2
• [ ] c) 3
• [ ] d) 6

1. How should an accepted risk be handled in a pipeline?

• [ ] a) Delete the check
• [ ] b) Record it in a suppression file with a reason and an expiry
• [ ] c) Turn off the pipeline
• [ ] d) Lower every severity

1. What is SARIF used for?

• [ ] a) Encrypting reports
• [ ] b) Showing findings in code review and analysis tools
• [ ] c) Compressing logs
• [ ] d) Signing releases

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• OASIS, Static Analysis Results Interchange Format (SARIF) Version 2.1.0: https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html
• NIST SP 800-115, Technical Guide to Information Security Testing and Assessment: https://csrc.nist.gov/pubs/sp/800/115/final

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.