Static and Dynamic Application Security Testing (SAST and DAST) CASEJAVA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the purpose of establishing a baseline when using SAST and DAST tools?

   • ATo eliminate the need for manual code review.
   • BTo track the security posture over time and identify new vulnerabilities introduced by code changes.
   • CTo make the tools run faster.
   • DTo ensure that the tools are installed correctly.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security team is evaluating SAST and DAST tools for a Java application. They have a requirement to identify vulnerabilities in custom business logic that involves complex data flow across multiple methods and classes. They also need to test the application's behavior when it is deployed with a specific configuration. Which combination of tools is most appropriate?

   • AUse SAST for data flow analysis and DAST for configuration-specific behavior.
   • BUse manual code review instead of automated tools.
   • CUse only DAST because it tests the running application.
   • DUse only SAST because it can analyze all code paths.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the purpose of fuzzing in DAST?

   • ATo analyze the source code for potential security flaws without executing it.
   • BTo crawl the application's web pages and map its structure for later analysis.
   • CTo send malformed or unexpected inputs to the application to trigger crashes or unexpected behavior that may indicate vulnerabilities.
   • DTo test the application's performance under heavy load.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A development team is integrating SAST into their CI pipeline. They have a large legacy codebase with many existing findings. The team wants to ensure that new code does not introduce new vulnerabilities, but they do not want to spend months fixing legacy issues before they can start using SAST. What is the best approach?

   • ASet a baseline of existing findings and fail the build only on new findings introduced by changed code.
   • BRun SAST only on new code and ignore legacy code entirely.
   • CDisable SAST in CI and run it only in a nightly job.
   • DBlock the build on all findings until the legacy issues are fixed.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A DAST scan of a web application reports a reflected XSS vulnerability in a search page. The security analyst wants to confirm the finding before reporting it to the development team. What is the most reliable way to validate the vulnerability?

   • AReview the source code of the search page to see if output encoding is used
   • BRe-run the DAST scan with the same payload and check the response for the payload
   • CAsk the developer if the page is vulnerable
   • DCheck the DAST report for the CVSS score and accept it if high
   Reveal Solution Discussion Select an answer first