Static Application Security Testing (SAST) CASENET Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A SAST tool is scanning a .NET web application and reports a potential insecure deserialization vulnerability. The developer is surprised because the code does not appear to call any deserialization methods directly. How can the SAST tool have detected this?

   • AThe tool used control flow analysis to identify all possible execution paths that lead to deserialization.
   • BThe tool executed the application and observed the deserialization behavior at runtime.
   • CThe tool performed data flow analysis and traced untrusted input into a deserialization call in a library or framework method.
   • DThe tool flagged the use of a common deserialization library, even if it is not actually called.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A .NET application has a SAST finding for a potential SQL injection. The developer reviews the code and finds that the input is validated with a whitelist of allowed characters before being used in a SQL query. The developer believes the finding is a false positive. What is the most appropriate action?

   • AIgnore the finding because the developer has confirmed the validation is sufficient.
   • BAsk the SAST tool vendor to remove the rule that flagged the finding.
   • CChange the code to use parameterized queries anyway to be safe.
   • DDocument the whitelist validation in the SAST tool and mark the finding as 'Not Exploitable' with a justification.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A SAST scan of a .NET application reports a 'Medium' severity finding for a potential path traversal vulnerability. The security team is triaging findings and has limited development resources. What is the most appropriate action?

   • AIgnore the finding because it is only Medium severity.
   • BClose the finding as a false positive without investigation.
   • CInvestigate the finding to confirm whether it is a true positive, then schedule a fix based on the actual risk.
   • DImmediately fix all Medium findings because they are all exploitable.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of Static Application Security Testing (SAST) in the software development lifecycle?

   • ATo identify security vulnerabilities in source code without executing the application
   • BTo test the application's runtime behavior under simulated attacks
   • CTo verify that the application meets functional requirements
   • DTo monitor production logs for security incidents
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   After a developer fixes a vulnerability identified by SAST, what is the recommended next step?

   • ADeploy the fix directly to production without further testing
   • BIgnore the finding because SAST often produces false positives
   • CRe-run the SAST scan to verify that the vulnerability is resolved and no new issues were introduced
   • DClose the vulnerability ticket without any further action
   Reveal Solution Discussion Select an answer first