[Security Design] What are the primary uses of the Rule Security Analyzer in Pega Platform? (Choose Two)

The Rule Security Analyzer (RSA) is a static analysis tool within the Pega Platform designed specifically to enhance application security. Its primary function is to scan an application's rules to proactively identify potential security risks. It achieves this by checking rules against a predefined set of security policies to find potential vulnerabilities, such as cross-site scripting (XSS) risks in custom code or unauthenticated access to activities. The tool flags rules that are not compliant with Pega's security guidelines, allowing developers to remediate issues before deployment.

A. To optimize rule performance: This is incorrect. Performance analysis and optimization are the primary functions of the Performance Analyzer (PAL) and other performance-related tools, not the Rule Security Analyzer.

B. To enforce coding standards: This is too general. While security is a component of coding standards, the RSA focuses specifically on security vulnerabilities, not broader best practices like naming conventions, which are addressed by Application Guardrails.

1. Pega Platform Documentation - Rule Security Analyzer: "Use the Rule Security Analyzer to search for security vulnerabilities in your application rules... The tool flags rules that might violate your organization's security policies

for example

unauthenticated access to an activity." This directly supports options C and D.

Source: Pega Community/Pega Documentation

"Securing an application with the Rule Security Analyzer".

2. Pega Platform Documentation - Improving application quality: "The Rule Security Analyzer tool improves application security by checking rules for security vulnerabilities

such as cross-site scripting." This statement explicitly links the tool to identifying vulnerabilities.

Source: Pega Academy

Lead System Architect (LSA) 8.x Mission

"Application Quality

" Module: "Improving application quality".

3. Pega Platform Documentation - Application Guardrails: "Application Guardrails help you track compliance with Pega's best practices... They are not focused solely on security but on overall application quality

including performance

maintainability

and reusability." This differentiates the broader role of Guardrails from the specific security focus of the RSA.

Source: Pega Community/Pega Documentation

"Understanding application quality and guardrails".