Static and Dynamic Application Security Testing (SAST and DAST) CASEJAVA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary purpose of Static Application Security Testing (SAST)?

   • ATo review the application's architecture and design documents to identify potential security flaws before any code is written.
   • BTo analyze source code, bytecode, or binary code without executing the application to identify security vulnerabilities.
   • CTo test a running application by sending malicious inputs and observing its responses to identify exploitable vulnerabilities.
   • DTo monitor production traffic and detect real-time attacks against the application using behavioral analysis.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   When interpreting DAST results, what does it mean to correlate findings with attack scenarios?

   • AChecking if the vulnerability appears in the OWASP Top 10.
   • BRunning the same scan multiple times to see if the result is consistent.
   • CMatching the discovered vulnerability to a specific attack pattern or exploit path to understand its real-world impact.
   • DComparing the vulnerability to a list of known software bugs.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A DAST scan of a Java web application reports a potential command injection in a file upload feature. The scanner sent a payload that caused the application to execute a system command. The security analyst wants to confirm the vulnerability is real and not a false positive. What should the analyst do?

   • AIgnore the finding because DAST tools are known to produce many false positives.
   • BManually reproduce the attack in a safe environment and observe the application's behavior.
   • CRun a SAST scan to confirm the finding.
   • DAccept the DAST result as a true positive because the scanner confirmed the command execution.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A SAST scan of a Java application reports a high-severity finding in a method that is called only from a background job that runs with elevated privileges. The finding is a potential SQL injection. The developer argues that the input to the method comes from a trusted internal queue, not from user input. The security team must decide whether to require a fix before release. What is the best decision?

   • AAccept the risk because the input comes from an internal queue and is trusted.
   • BRequire a fix because the SAST tool assigned high severity.
   • CAnalyze the trust boundary and the source of the queue data; if the queue is truly trusted and cannot be influenced by an attacker, document the finding as a false positive or accepted risk.
   • DRun a DAST scan against the background job to confirm the vulnerability.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is a best practice for configuring SAST tools to reduce false positives?

   • ARunning the tool with all default settings and never changing them.
   • BOnly running SAST on the final release candidate.
   • CDisabling all security rules to avoid false positives.
   • DTuning the tool's rules and sensitivity settings to match the application's technology stack and context.
   Reveal Solution Discussion Select an answer first