Static Application Security Testing (SAST) CASENET Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A development team uses Azure DevOps for CI/CD. They want to run SAST on every pull request to a .NET repository, but they are concerned about blocking developers on false positives. Which approach best balances security and developer productivity?

   • ARun SAST in the pull request pipeline and fail the build only on 'High' and 'Critical' findings, while reporting 'Medium' and 'Low' as warnings.
   • BRun SAST in a separate nightly build and email the results to the security team only.
   • CDisable all SAST rules that generate false positives to ensure the build never fails on a false positive.
   • DRun SAST only on the main branch after merge, so developers are never blocked by scan results.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SAST tool reports a potential insecure deserialization vulnerability in a .NET web API. The code uses BinaryFormatter to deserialize data from a request body. The team is unsure if the finding is a true positive. What characteristic of SAST analysis should the team consider when evaluating this finding?

   • ASAST performs data flow analysis to trace whether untrusted input reaches the deserialization call.
   • BSAST relies on runtime behavior to determine if the deserialization is exploitable.
   • CSAST executes the code with test inputs to see if the deserialization actually fails.
   • DSAST only checks for syntax errors and cannot detect deserialization issues.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team is configuring a SAST tool for a .NET application that processes PII. The tool currently uses a default ruleset that flags many issues, but the team is overwhelmed by the volume of findings. They want to focus on the most critical risks while still meeting compliance requirements. What is the most appropriate configuration?

   • AIncrease the severity threshold to 'Critical' to reduce the number of findings.
   • BUse the default ruleset and manually triage all findings.
   • CCustomize the ruleset to include only rules that map to the organization's compliance requirements and the most common attack vectors.
   • DDisable all rules except for SQL injection and XSS.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A development team is adopting SAST for the first time. They want to integrate it into their CI pipeline to catch vulnerabilities early. Which of the following is a key benefit of SAST in this context?

   • AIt can detect runtime configuration issues that only appear in production.
   • BIt can replace the need for dynamic application security testing (DAST).
   • CIt can identify vulnerabilities in code before the code is compiled or deployed.
   • DIt can automatically fix all identified vulnerabilities without developer intervention.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A SAST tool is analyzing a .NET application and reports a potential SQL injection vulnerability. The developer reviews the code and sees that the query is built using string concatenation, but the input is sanitized with a custom function that removes single quotes. The developer believes the sanitization is sufficient. What is the most appropriate response?

   • AModify the custom sanitization function to also remove semicolons and dashes.
   • BAccept the finding as a false positive because the sanitization removes single quotes.
   • CExplain that custom sanitization is not a reliable defense and recommend using parameterized queries.
   • DAsk the SAST tool vendor to suppress the finding because the code is safe.
   Reveal Solution Discussion Select an answer first