Static and Dynamic Application Security Testing (SAST and DAST) CASEJAVA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A development team wants to reduce the number of security defects reaching the code review stage. They have a SAST tool that can run locally. Which integration point is most effective for catching vulnerabilities before a developer commits code?

   • ARun SAST as a pre-commit hook in the developer's IDE
   • BRun SAST manually on an ad-hoc basis when security issues are reported
   • CRun SAST nightly on the main branch
   • DRun SAST only when a release candidate is created
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a common DAST tool?

   • ACheckmarx
   • BVeracode
   • CFortify SCA
   • DOWASP ZAP
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security team wants to run DAST against a Java application that is deployed in a staging environment. The application requires authentication to access most features. What is the most important configuration step to ensure the DAST scan is effective?

   • ARun the scan only on the login page
   • BConfigure the DAST tool with valid credentials and ensure the scan can authenticate to the application
   • CUse a DAST tool that does not support authentication
   • DDisable authentication for the staging environment
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A SAST scan of a Java application reports a potential SQL injection in a method that builds a query using string concatenation. The developer reviews the code and sees that the input is sanitized with a custom function that escapes single quotes. The SAST tool does not recognize the sanitization. What is the most appropriate action?

   • AReview the custom sanitization function to ensure it is effective, and if so, document the finding as a false positive with justification.
   • BTreat the finding as a true positive because the SAST tool flagged it.
   • CTreat the finding as a false positive because the custom sanitization is sufficient.
   • DDisable the SQL injection rule in the SAST tool to avoid future false positives.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In which environment is DAST typically performed to test the application before production release?

   • AProduction environment only.
   • BDeveloper's local machine only.
   • CStaging environment that closely mirrors production.
   • DA sandbox with no network access.
   Reveal Solution Discussion Select an answer first