Why should you scan dependencies during a vulnerability assessment?

• A. Dependencies, if vulnerable, can be exploited to gain access to sensitive data or systems.
• B. Dependencies are always secure and can be ignored.
• C. Only the main application code matters for vulnerabilities.
• D. Dependencies do not affect overall security.

Answer: (A)

Dependencies are external libraries and frameworks your project relies on. They often come with their own vulnerabilities, and attackers can exploit those flaws through your application even if your own code is solid. Scanning dependencies helps you discover vulnerable versions, outdated components, and transitive dependencies you might not realize are part of your supply chain. This information is crucial for patching and reducing risk, since a weakness in a dependency can become an entry point for data exposure or system compromise. So, dependency scanning is a vital part of a vulnerability assessment. The other statements miss the reality that dependencies can be insecure and do affect overall security.