Static Application Security Testing (SAST) CASENET Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An organization's security policy requires that all .NET applications comply with OWASP Top 10. The SAST tool is currently configured with a custom rule set that only checks for SQL injection and XSS. What should the security team do to align the SAST configuration with the policy?

   • AEnable the OWASP Top 10 rule set in the SAST tool and configure the policy to fail the build on any OWASP Top 10 finding.
   • BKeep the custom rule set and manually review the code for other OWASP Top 10 vulnerabilities.
   • CAdd a few more custom rules for the most common OWASP Top 10 items, such as broken authentication and sensitive data exposure.
   • DRun the SAST tool with the default rule set and rely on the tool's default severity thresholds.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A .NET application has a SAST finding for a potential insecure deserialization vulnerability. The code uses Json.NET with a custom SerializationBinder that restricts types to a safe allowlist. The developer believes the finding is a false positive. What is the most appropriate action?

   • AIgnore the finding because the developer has implemented a binder.
   • BReview the SerializationBinder implementation to ensure it cannot be bypassed, then document the finding as 'Not Exploitable' if it is safe.
   • CReplace Json.NET with BinaryFormatter to avoid the finding.
   • DMark the finding as 'High' severity because any deserialization is risky.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary advantage of integrating SAST into a CI/CD pipeline?

   • AIt eliminates the need for any manual security testing
   • BIt automates security testing on every code commit, providing immediate feedback to developers
   • CIt speeds up the compilation of the source code
   • DIt guarantees that no vulnerabilities are introduced after deployment
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A .NET team uses a SAST tool that generates a high number of false positives for a custom validation framework they built. The false positives are drowning out real findings. The team wants to reduce noise without losing coverage. What is the most appropriate approach?

   • ACreate custom rules or suppression annotations that specifically target the validation framework's patterns, and review the suppressions periodically.
   • BStop using SAST and rely on manual code reviews for security.
   • CIncrease the severity threshold so that only 'High' and 'Critical' findings are reported.
   • DDisable all SAST rules that relate to input validation to eliminate the false positives.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A .NET solution is built using Jenkins. The security team wants to integrate SAST so that every build automatically runs the scan and publishes the results to the team. Which integration approach is most appropriate?

   • AAdd a Jenkins pipeline stage that runs the SAST tool after the build step and archives the report as a build artifact.
   • BCreate a separate Jenkins job that runs SAST only when triggered manually by the security team.
   • CUse a post-build action to run SAST only on the release branch, not on feature branches.
   • DRun the SAST tool manually on a developer's machine and share the report via email.
   Reveal Solution Discussion Select an answer first