Static and Dynamic Application Security Testing (SAST and DAST) CASEJAVA Practice Questions (Page 11)

Questions 51–55

1. 51application · medium

   A Java developer is reviewing a SAST report that flags a potential path traversal vulnerability. The code reads a user-supplied filename and uses it to open a file. The developer notices that the SAST tool traced the input from the HTTP request through several method calls to the file operation. Which SAST technique is the tool using?

   • ACrawling
   • BTaint analysis
   • CPenetration testing
   • DFuzzing
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   A security team is configuring a SAST tool for a Java codebase. The tool produces many findings that are not actually exploitable because the code is legacy and uses patterns the scanner does not understand. The team wants to reduce noise while still catching real issues. What is the best approach?

   • ARun the SAST tool only on new code and ignore legacy code entirely.
   • BDisable all rules that generate false positives to make the report cleaner.
   • CCreate a baseline of known false positives and configure the tool to suppress them, while reviewing new findings.
   • DIncrease the severity threshold so only critical findings are reported.
   Reveal Solution Discussion Select an answer first
4. 53expert · hard

   A security team is using SAST and DAST for a Java application. They have noticed that SAST reports many false positives, and DAST misses some vulnerabilities that are only visible in the source code. The team wants to improve their testing program. What is the most effective way to address these limitations?

   • AUse SAST and DAST together, tune the SAST tool to reduce false positives, and use manual review to validate findings.
   • BStop using SAST and rely only on DAST to avoid false positives.
   • CReplace SAST and DAST with a single tool that claims to do both.
   • DStop using DAST and rely only on SAST to catch all code issues.
   Reveal Solution Discussion Select an answer first
5. 54foundation · easy

   Which of the following is a limitation of SAST?

   • AIt cannot detect vulnerabilities that only appear at runtime, such as authentication bypasses or misconfigurations.
   • BIt requires a running application and cannot analyze source code.
   • CIt can only be used on compiled binaries, not source code.
   • DIt is unable to identify any security vulnerabilities.
   Reveal Solution Discussion Select an answer first
6. 55expert · hard

   A SAST tool reports a high-severity SQL injection finding in a legacy Java module. The development team argues that the module is not exposed to user input because it is only called internally by other services. The security team must decide how to handle the finding. What is the best course of action?

   • ASuppress the finding without investigation because the team says it is not exposed
   • BInvestigate the data flow to determine if any untrusted input can reach the vulnerable method, and if not, suppress the finding with justification
   • CImmediately require the team to fix the finding because it is high severity
   • DEscalate to management to decide
   Reveal Solution Discussion Select an answer first