Free Practice Questions for Checkmarx CxCE

Exam-style questions and explanations by OpenExamPrep.

✓ No registration✓ No credit card

100+ Questions

100% Free

Loading practice questions...

Exam Review

Key Facts: Checkmarx CxCE Exam

Multiple choice

The CxCE certification exam is a multiple-choice assessment delivered in the Checkmarx Learning Center

Checkmarx - Certified Engineer (CxCE)

CxSAST

Static Application Security Testing is the core focus, including scan configuration, CxQL queries and results triage

Checkmarx - Certified Engineer (CxCE)

Checkmarx One

Unified cloud platform combining SAST, SCA, IaC Security/KICS and API Security

Checkmarx One Documentation

OWASP Top 10

Application-security fundamentals on the exam map to the OWASP Top 10 and the secure SDLC

OWASP Top 10 project

KICS

Checkmarx IaC Security is powered by the open-source KICS engine for infrastructure-as-code scanning

Checkmarx Documentation

Not published

Checkmarx does not publish a fixed public question count, time limit or passing percentage for CxCE

Checkmarx - Certifications

DevSecOps

Checkmarx integrates with Jenkins, GitLab, GitHub and Azure DevOps via plugins, CLI and pipeline thresholds

Checkmarx Documentation

100

Free original CxCE practice questions provided here

OpenExamPrep

The Checkmarx Certified Engineer (CxCE) is Checkmarx's professional certification for engineers who configure and operate its application-security platform within a secure SDLC. It is an online multiple-choice exam delivered through the Checkmarx Learning Center, weighted toward CxSAST scan configuration and results triage (projects, presets, CxQL queries, result states, false positives, best-fix location, incremental scans) plus the Checkmarx One platform (SAST, SCA, IaC Security/KICS, API Security). It also covers application-security fundamentals such as the OWASP Top 10 and how SAST differs from DAST, SCA and IAST, along with CI/CD integration via Jenkins, GitLab, GitHub and Azure DevOps and developer remediation guidance. Checkmarx does not publish a fixed public question count, time limit, passing percentage or standalone price; candidates pass the threshold set inside the Learning Center. This 100-question bank provides original practice across all of those areas with explanations for every option.

Sample Checkmarx CxCE Practice Questions

Try these sample questions to review concepts for the Checkmarx CxCE exam. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1In Checkmarx SAST, which result state should an engineer assign to a finding they have reviewed and determined is a genuine, real vulnerability that must be fixed?

A.Not Exploitable

B.Confirmed

C.To Verify

D.Proposed Not Exploitable

Explanation: Marking a result as Confirmed records that an engineer reviewed it and verified it is a real, exploitable vulnerability requiring remediation. This keeps it visible and tracked across future scans.

2A developer marks a CxSAST finding as 'Not Exploitable' with a reason. What is the primary effect of this state on subsequent scans?

A.The finding is deleted from the database

B.The finding is suppressed and excluded from the active risk count in future scans

C.The query that produced it is disabled globally

D.The whole project is re-scanned automatically

Explanation: Not Exploitable suppresses the finding so it no longer counts toward active risk, while preserving an audit trail of who marked it and why. The result persists for the same vulnerability path on later scans.

3In Checkmarx SAST, what is a 'preset'?

A.A saved set of CxQL queries that defines which vulnerability checks run in a scan

B.A list of user accounts allowed to view results

C.A schedule that controls when scans execute

D.A network proxy configuration for the scanner

Explanation: A preset is a named collection of CxQL queries that determines which vulnerabilities a scan looks for. Teams pick or customize presets to tune coverage and noise per project.

4What is the core difference between Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST)?

A.SAST analyzes a running application; DAST analyzes source code

B.SAST analyzes source code without executing it; DAST tests a running application from the outside

C.Both require the application to be deployed and running

D.SAST only checks open-source libraries; DAST only checks first-party code

Explanation: SAST is white-box analysis of source or binaries without running the app, so it can run early in the SDLC. DAST is black-box testing of a deployed, running application, finding runtime and configuration issues.

5Which Checkmarx capability is specifically designed to find vulnerabilities and license risks in open-source and third-party dependencies?

A.CxSAST

B.SCA (Software Composition Analysis)

C.KICS

D.DAST

Explanation: Software Composition Analysis (SCA) inventories open-source and third-party components, flags known CVEs, and reports license obligations. It complements SAST, which analyzes first-party source code.

6In a CxSAST data-flow result, the 'source' and 'sink' represent which two points?

A.The first and last lines of the file

B.Where untrusted data enters the application and where it is dangerously used

C.The login and logout endpoints

D.The scan start and scan end timestamps

Explanation: In taint analysis the source is where untrusted/tainted data enters (e.g. user input), and the sink is where that data reaches a dangerous operation (e.g. a SQL query). The attack vector traces the flow between them.

7Why is the 'best-fix location' that CxSAST identifies in an attack vector useful to a developer?

A.It is the line with the most comments

B.It is a single node where a fix can remediate the vulnerability, often resolving multiple flows at once

C.It is the line that runs fastest

D.It marks where the scan should be paused

Explanation: The best-fix location is the optimal node in the data flow to apply a remediation, such as adding input validation or output encoding. Fixing there can close many converging attack vectors with a single change.

8Which OWASP Top 10 category does a SQL injection vulnerability fall under in the OWASP Top 10 (2021)?

A.A01: Broken Access Control

B.A03: Injection

C.A07: Identification and Authentication Failures

D.A09: Security Logging and Monitoring Failures

Explanation: SQL injection is part of A03: Injection in the OWASP Top 10 (2021), which also covers command, LDAP and other injection flaws caused by unsanitized input reaching an interpreter.

9An engineer wants Checkmarx to scan Terraform and Kubernetes manifests for misconfigurations. Which Checkmarx engine performs this?

A.SAST

B.IaC Security powered by KICS

C.SCA

D.API Security

Explanation: Checkmarx IaC Security is powered by the open-source KICS engine, which scans infrastructure-as-code such as Terraform, Kubernetes, CloudFormation and Dockerfiles for security misconfigurations.

10What is the main benefit of running an incremental scan in CxSAST instead of a full scan?

A.It scans the entire codebase from scratch every time

B.It scans only code that changed since the last full scan, reducing scan time

C.It disables all queries to finish faster

D.It only scans third-party libraries

Explanation: An incremental scan analyzes only the files changed since the previous full/baseline scan, dramatically reducing scan time. This makes it well suited to fast CI/CD feedback, with periodic full scans for completeness.

About the Checkmarx CxCE Exam

The Checkmarx Certified Engineer (CxCE) credential validates that an engineer can operate Checkmarx application-security tooling within a secure software development lifecycle. The program centers on Checkmarx Static Application Security Testing (CxSAST) - configuring projects, scans and presets; customizing queries with CxQL; and reading and triaging results using data-flow attack vectors, best-fix location, severity and result states such as Confirmed and Not Exploitable. It extends to the Checkmarx One unified cloud platform, which brings SAST, SCA (software composition analysis), IaC Security via KICS, API Security and supply-chain security together, and to integrating Checkmarx into CI/CD pipelines through plugins, the CLI and build-breaking thresholds. The exam is multiple choice and is delivered online through the Checkmarx Learning Center at the end of the Certified Engineer learning path. It is intended for AppSec engineers, DevSecOps practitioners, developers and security champions.

Exam sponsor: Checkmarx (Checkmarx Learning Center). The requirements and fees below concern the certification or admission exam, separate from our free practice resources.

Assessment

Online multiple-choice certification exam taken at the end of the Checkmarx Certified Engineer learning path, covering application-security fundamentals, CxSAST scan configuration and results triage, the Checkmarx One platform, SCA, IaC Security (KICS) and CI/CD integration.

Time Limit

Checkmarx does not publish a fixed public time limit; the CxCE exam is an online multiple-choice assessment in the Checkmarx Learning Center.

Passing Score

Checkmarx does not publish a fixed public passing percentage; candidates must reach the passing threshold configured in the Checkmarx Learning Center to earn the credential.

Exam / Certification Fees

No standalone public price is published; the CxCE exam is delivered through the Checkmarx Learning Center as part of the certification training path, typically provided to Checkmarx customers and partners.

Exam sponsor website

Fees, eligibility, and exam policies can change. Confirm them with the exam sponsor before applying or paying.

Official sources

Our practice resources: topics covered

We aim to reflect publicly available exam outlines and topic information in our study resources. Coverage, format, and difficulty may differ from the actual exam, and we cannot guarantee that every detail is accurate or current. Confirm exam requirements, fees, and policies with the official exam sponsor.

20%

Application Security Fundamentals

OWASP Top 10 vulnerability classes including injection and SQL injection, cross-site scripting, broken access control, server-side request forgery and insecure deserialization; the secure SDLC (sSDLC) and shift-left security; and how static analysis (SAST) compares with DAST, SCA and IAST in coverage and timing.

35%

CxSAST Scan Configuration and Results Triage

Creating and configuring projects, scans and presets; customizing detection logic with CxQL queries; interpreting scan results, data-flow attack vectors and best-fix location; managing result states such as To Verify, Confirmed, Urgent and Not Exploitable; severity, false-positive handling and incremental versus full scans.

20%

Checkmarx One Platform

The unified cloud platform: SAST, SCA software composition analysis, IaC Security powered by KICS, API Security, container security and supply-chain security; navigating the Checkmarx One UI, scanners and results, and understanding how engines combine in a single scan.

15%

SCA, CI/CD and DevSecOps Integration

Identifying vulnerable open-source dependencies and CVEs, license risk and SBOM generation; integrating Checkmarx with Jenkins, GitLab, GitHub Actions and Azure DevOps using plugins, the CLI and pipelines; setting thresholds and break-the-build policies in a DevSecOps workflow.

10%

Administration and Remediation

Managing users, teams and projects with role-based access control; reading findings to give developers actionable remediation guidance; and tracking and reducing risk across projects over time.

Preparing for the Checkmarx CxCE Exam

What You Need to Know

Passing score: Checkmarx does not publish a fixed public passing percentage; candidates must reach the passing threshold configured in the Checkmarx Learning Center to earn the credential.
Assessment: Online multiple-choice certification exam taken at the end of the Checkmarx Certified Engineer learning path, covering application-security fundamentals, CxSAST scan configuration and results triage, the Checkmarx One platform, SCA, IaC Security (KICS) and CI/CD integration.
Time limit: Checkmarx does not publish a fixed public time limit; the CxCE exam is an online multiple-choice assessment in the Checkmarx Learning Center.
Exam / certification fees: No standalone public price is published; the CxCE exam is delivered through the Checkmarx Learning Center as part of the certification training path, typically provided to Checkmarx customers and partners. Official sources

Using Our Practice Resources

Work through all 100 available questions
Review every answer and explanation
Track weak areas and revisit them
Use our AI tutor for tough concepts

Checkmarx CxCE: Suggested Study Strategy

1Master the CxSAST result lifecycle: know exactly when to use To Verify, Confirmed, Urgent and Not Exploitable, and how marking a result as Not Exploitable suppresses it in future scans.

2Be able to read a data-flow attack vector from source to sink and identify the best-fix location, since fixing at the right node can remediate many findings at once.

3Learn how presets and CxQL queries control what a scan detects; practice describing how customizing a query reduces false positives without hiding real vulnerabilities.

4Know the engine boundaries: SAST scans code, SCA scans open-source dependencies and licenses, IaC Security (KICS) scans infrastructure-as-code, and DAST tests the running app - and how Checkmarx One unifies them.

5Practice the CI/CD story end to end: plugin or CLI invocation, thresholds, and break-the-build policies that fail a pipeline when high-severity findings appear.

6Tie every Checkmarx concept back to an OWASP Top 10 category and the secure SDLC so you can answer fundamentals questions as confidently as product questions.

Frequently Asked Questions

What is the Checkmarx Certified Engineer (CxCE) certification?

CxCE is Checkmarx's professional credential for engineers who configure and operate its application-security tools, especially Checkmarx SAST (CxSAST) and the Checkmarx One platform, within a secure software development lifecycle. It is earned by passing a multiple-choice exam after the Certified Engineer learning path.

What topics does the CxCE exam cover?

It covers application-security fundamentals (OWASP Top 10, the secure SDLC, SAST versus DAST, SCA and IAST), CxSAST scan configuration and results triage (presets, CxQL queries, result states, false positives, best-fix location), the Checkmarx One platform (SAST, SCA, IaC Security/KICS, API Security), CI/CD integration and remediation guidance.

How many questions are on the CxCE exam and what is the passing score?

Checkmarx does not publish a fixed public question count, time limit or passing percentage. The exam is multiple choice and is delivered through the Checkmarx Learning Center, where the passing threshold is configured. Confirm current details with Checkmarx or your account team.

What is the difference between SAST, SCA and DAST in Checkmarx?

SAST (CxSAST) analyzes source code statically for vulnerabilities like SQL injection and XSS. SCA analyzes open-source dependencies for known CVEs and license risk. DAST tests a running application from the outside. Checkmarx One combines these engines, plus IaC and API security, on one platform.

What is a preset in Checkmarx SAST?

A preset is a named collection of CxQL queries that defines which vulnerability checks run in a scan. Choosing or customizing a preset lets teams tune coverage and noise for a project, for example focusing on the OWASP Top 10 or a specific compliance set.

Are these official Checkmarx practice questions?

No. These are original OpenExamPrep practice questions and are not affiliated with or endorsed by Checkmarx. Use them alongside the official Checkmarx Learning Center training and documentation when preparing for the CxCE exam.