Static Application Security Testing (SAST) CASENET Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is a potential risk when remediating a SAST finding by adding input validation?

   • AThe validation might break legitimate functionality if not implemented correctly
   • BThe validation will increase the false positive rate of the SAST tool
   • CThe validation will make the application slower in all scenarios
   • DThe validation will automatically fix all other vulnerabilities
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A .NET team wants to add SAST to their CI pipeline, but they are concerned about slowing down the build. The codebase is large, and a full scan takes over an hour. Which approach best addresses this concern while maintaining security coverage?

   • ARun the full SAST scan only on release branches.
   • BReduce the SAST ruleset to only critical rules to speed up the scan.
   • CRun a full SAST scan nightly and an incremental scan on pull requests.
   • DDisable SAST in CI and run it manually before each release.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A .NET team uses GitHub Actions for CI. They want to run SAST on every push to any branch, but they are concerned about the cost of running scans on every push. What is the most cost-effective approach that still provides security coverage?

   • ARun SAST on pull requests and on the main branch, but not on every push to feature branches.
   • BRun SAST manually on a schedule, such as weekly, to reduce cost.
   • CRun SAST only on the main branch after merge, and skip pull request scans.
   • DRun SAST on every push to every branch to ensure maximum coverage.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A .NET team is integrating SAST into their CI pipeline. They have a large monorepo with multiple solutions. The security team wants to enforce a policy that no new High or Critical vulnerabilities are introduced, but they also want to avoid blocking the pipeline on legacy issues. The team is considering using a baseline. What is the most appropriate way to implement this?

   • ACreate a baseline of existing findings and configure the SAST tool to fail the build only on new findings that are not in the baseline.
   • BRun SAST only on the solutions that are actively developed and ignore legacy solutions.
   • CFail the build on all High and Critical findings, including legacy ones, to force remediation.
   • DUse a SAST tool that does not support baselines and manually review all findings.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A .NET team has just integrated a SAST tool into their CI pipeline. The tool currently fails the build on any 'High' or 'Critical' finding, but developers complain that many of these findings are in legacy code that is not part of the current sprint. The security lead wants to keep the pipeline fast and avoid blocking unrelated work. What is the most appropriate configuration?

   • ARun the SAST tool only on a nightly schedule and never fail the build.
   • BLower the severity threshold to 'Medium' so the build fails more often, forcing developers to fix legacy issues.
   • CDisable the SAST tool for legacy projects and only run it on new projects.
   • DSet the SAST tool to only scan code changed in the current pull request and fail the build only for new High/Critical findings in that diff.
   Reveal Solution Discussion Select an answer first