Static and Dynamic Application Security Testing (SAST and DAST) CASEJAVA Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   When interpreting SAST results, what is a false positive?

   • AA vulnerability that is fixed automatically by the tool.
   • BA vulnerability that exists but is not reported by the tool.
   • CA reported vulnerability that does not actually exist in the code.
   • DA vulnerability that is reported but cannot be exploited.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the first step in prioritizing SAST findings?

   • AFix all findings in the order they appear in the report.
   • BAutomatically close all findings without review.
   • CReview the severity rating and exploitability of each finding.
   • DIgnore all findings that are not exploitable.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security team uses SAST in the CI pipeline and DAST in the staging environment. They notice that some vulnerabilities are found by DAST but not by SAST. What is the most likely reason for this gap?

   • ADAST is more thorough than SAST and always finds more vulnerabilities
   • BSAST is only designed to find syntax errors, not security vulnerabilities
   • CSAST cannot detect vulnerabilities that depend on runtime behavior and configuration
   • DThe DAST tool is misconfigured and producing false positives
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security team wants to run DAST against a Java application that is deployed in a staging environment. The application has a complex workflow that requires multiple steps to reach certain functionality. The DAST tool's crawler is not able to navigate the workflow automatically. What is the best way to ensure the DAST scan covers the complex workflow?

   • AManually script the workflow in the DAST tool to guide it through the multi-step process
   • BSkip the complex workflow and test only the main pages
   • CRun the DAST scan multiple times with different payloads
   • DUse a different DAST tool that has a better crawler
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A Java web application team runs a SAST scan in CI and receives a report listing a potential SQL injection in a legacy DAO class. The finding has a high severity score, but the code path is only reachable when the application is started with a special debug flag that is never set in production. The team is under pressure to fix all high-severity findings before release. What should the team do first?

   • ATreat the finding as exploitable because the scanner assigned high severity, and schedule an immediate fix.
   • BRun a DAST scan against the production environment to see if the SQL injection is actually exploitable before deciding.
   • CAnalyze the reachability of the code path, confirm whether the debug flag can be enabled in any supported environment, and then decide whether to fix or document as a false positive.
   • DMark the finding as a false positive and close it without further action.
   Reveal Solution Discussion Select an answer first