Static Application Security Testing (SAST) CASENET Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company develops a .NET application that handles payment card data and must comply with PCI DSS. The SAST tool is configured with a generic rule set. What should the security team do to ensure the SAST configuration supports PCI DSS compliance?

   • ADisable rules that produce false positives to speed up the scan and reduce noise.
   • BRun SAST only once before the annual PCI DSS audit to save time.
   • CUse the generic rule set because it already covers all possible vulnerabilities.
   • DEnable a PCI DSS-specific rule set or custom rules that check for common vulnerabilities relevant to cardholder data, such as injection and insecure storage.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A developer fixes a SAST finding for an XSS vulnerability by adding HTML encoding to the output. After re-running SAST, the finding is gone. However, a security reviewer notices that the encoding is applied in the wrong layer, and the data is still vulnerable in a different output context. What is the most appropriate action?

   • AAccept the fix because SAST no longer reports the finding, and the reviewer's concern is theoretical.
   • BChange the SAST rule to not flag this type of XSS to avoid the confusion.
   • CAdd a comment in the code explaining that the encoding is sufficient and close the finding.
   • DReopen the finding and apply context-aware encoding at the correct output point, then re-run SAST and perform a manual review.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   When prioritizing SAST findings for remediation, which factor should be considered first?

   • AThe number of lines of code in the affected function
   • BThe severity level assigned by the tool
   • CThe order in which the findings appear in the report
   • DThe file name where the vulnerability was found
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An organization has a custom rule in their SAST tool that flags any use of the 'DES' cryptographic algorithm. A developer receives a finding for using 'DES' in a legacy module that is being phased out. The security team wants to enforce the rule but not block the release. What is the most appropriate action?

   • ARemove the custom rule from the SAST tool to avoid the finding.
   • BForce the developer to rewrite the module immediately to use a stronger algorithm.
   • CIgnore the finding because the module is being phased out.
   • DAdd the legacy module to a suppression list with a justification and an expiration date.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is a key benefit of integrating SAST into the software development lifecycle?

   • AIt identifies vulnerabilities early, reducing the cost and effort of fixing them later
   • BIt eliminates the need for manual code reviews
   • CIt automatically fixes all identified vulnerabilities without developer intervention
   • DIt guarantees that no vulnerabilities exist in the final code
   Reveal Solution Discussion Select an answer first