Static and Dynamic Application Security Testing (SAST and DAST) CASEJAVA Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A development team is adopting SAST in a large legacy Java codebase. The initial scan produces thousands of findings, many of which are false positives. The team is overwhelmed and considering abandoning the tool. What is the best strategy to make the SAST program sustainable?

   • AFail the build on all findings to force the team to fix everything
   • BEstablish a baseline of current findings, triage them, suppress confirmed false positives, and then set a policy to fail the build only on new critical/high findings
   • CDisable the SAST tool and rely on DAST
   • DOnly run SAST on new code and ignore the legacy codebase
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Which of the following is a key difference between SAST and DAST?

   • ASAST can only find runtime configuration issues, while DAST can only find coding syntax errors.
   • BSAST is performed only in production, while DAST is performed only in development.
   • CSAST requires a deployed application, while DAST requires access to source code.
   • DSAST analyzes code without executing it, while DAST tests a running application.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   What is the primary purpose of Dynamic Application Security Testing (DAST)?

   • ATo analyze source code for security flaws without executing the application.
   • BTo test a running application by simulating attacks and observing its behavior to identify exploitable vulnerabilities.
   • CTo scan the application's dependencies and libraries for known vulnerabilities.
   • DTo review the application's configuration files and deployment scripts for security misconfigurations.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A security team uses SAST and DAST in their SDLC. They want to reduce the number of false positives reported by SAST without missing real vulnerabilities. Which practice is most effective?

   • ACustomize the SAST rule set to match the application's technology stack and suppress known false positives with justification
   • BUse the default rule set and ignore all findings that are not confirmed by DAST
   • CRun SAST only on code that has changed in the last commit
   • DIncrease the severity threshold to only report critical findings
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   How can SAST be integrated into a CI/CD pipeline?

   • ABy using SAST to test the application in production.
   • BBy running SAST only on the final release candidate.
   • CBy adding a SAST scan step that runs automatically on every code commit or build.
   • DBy manually running SAST once before each release.
   Reveal Solution Discussion Select an answer first