Static and Dynamic Application Security Testing (SAST and DAST) CASEJAVA Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Why is it important to validate DAST findings in the application context?

   • ATo check if the application meets performance requirements.
   • BTo determine if the application is using the latest version of Java.
   • CTo ensure that the DAST tool has been properly installed.
   • DTo confirm that the vulnerability is actually exploitable given the application's logic, configuration, and environment.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A development team wants to introduce SAST into their Java project without slowing down developers. They currently use Git with a pre-commit hook and a Jenkins CI pipeline that runs unit tests on every push. Which integration approach best balances early feedback with build performance?

   • ARun the full SAST scan only in the pre-commit hook and skip CI scanning to avoid duplicate work.
   • BRun a fast, incremental SAST scan on changed files in the pre-commit hook and the full scan in CI on every push.
   • CRun the full SAST scan only in a nightly Jenkins job and email the results to the team.
   • DRun SAST only in the production deployment pipeline after the code is released.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A development team is integrating SAST into their CI/CD pipeline. They want to ensure that critical vulnerabilities are fixed before deployment, but they do not want to block developers on false positives. What is the best practice?

   • AFail the build on any SAST finding, regardless of severity.
   • BNever fail the build; only generate a report for manual review.
   • CFail the build on all high-severity findings, regardless of false positive status.
   • DFail the build only on findings that are confirmed as true positives by a human reviewer.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A security team is responsible for a Java application that processes sensitive data. They have a limited budget and must choose between investing in SAST or DAST. The application is in active development with frequent code changes, and it is also deployed in a production environment that cannot be easily taken offline. The team wants to identify vulnerabilities early and also validate runtime behavior. What is the most balanced approach?

   • AInvest in manual penetration testing instead of automated tools.
   • BInvest in SAST for CI and DAST for staging, using production scans only for non-intrusive checks.
   • CInvest only in SAST and run it in CI to catch vulnerabilities early.
   • DInvest only in DAST and run it in staging to validate runtime behavior.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A Java development team wants to integrate SAST into their CI pipeline. They have a large codebase and the SAST scan takes 45 minutes. The team wants to provide fast feedback to developers without slowing down the pipeline. What is the best approach?

   • ARun a fast SAST scan on changed files in the pull request, and run the full SAST scan nightly on the main branch
   • BRun the full SAST scan only on the main branch after merge
   • CRun SAST only on release candidates
   • DRun the full SAST scan on every commit in the CI pipeline
   Reveal Solution Discussion Select an answer first