Static and Dynamic Application Security Testing (SAST and DAST) CASEJAVA Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A security team is deciding whether to use SAST or DAST for a Java application that is already in production. The application has a large codebase with many third-party libraries. The team wants to identify vulnerabilities that are actually reachable by an attacker. Which approach is more appropriate?

   • ABoth are equally effective for production testing.
   • BNeither, because production applications cannot be tested for security.
   • CDAST, because it tests the running application and can identify vulnerabilities that are reachable through the exposed interface.
   • DSAST, because it can analyze all code paths including third-party libraries.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A DAST scan of a Java web application reports a reflected XSS vulnerability in the search functionality. The scanner shows that the payload appears in the response, but the application's Content-Security-Policy (CSP) header is set to a strict policy that blocks inline scripts. What should the security analyst do?

   • AManually verify in a browser whether the payload actually executes despite the CSP, and then decide if the finding is a true positive.
   • BAsk the development team to remove the CSP header so the scanner can accurately test for XSS.
   • CReport the finding as a confirmed XSS because the payload is reflected in the response.
   • DIgnore the finding because CSP always blocks all XSS attacks.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   At which stage of the software development lifecycle is SAST most effectively applied?

   • ADuring the requirements gathering phase, before any code is written.
   • BOnly after the application is deployed to production and is receiving live traffic.
   • CDuring the decommissioning phase, when the application is being retired.
   • DDuring the development and build phases, before the application is deployed.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A DAST scan of a Java web application reports a stored XSS vulnerability in a comment feature. The security analyst wants to confirm the vulnerability before reporting it. The analyst has access to the application and can create test accounts. What is the most reliable validation method?

   • ASubmit a payload in a comment, then access the comment as another user and observe if the payload executes
   • BReview the source code to see if output encoding is used
   • CRe-run the DAST scan and check the response for the payload in the same request
   • DCheck the DAST report for the severity and accept it if high
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A Java developer is using a SAST tool that performs data flow analysis. The tool reports that a user-controlled parameter flows into a dangerous method without proper validation. The developer wants to understand the exact path the data takes through the code. What should the developer look for in the SAST report?

   • AA list of all user inputs that were fuzzed during testing.
   • BA list of all HTTP requests made to the application.
   • CA data flow trace showing the source, propagation points, and sink.
   • DA list of all third-party libraries used by the application.
   Reveal Solution Discussion Select an answer first