A .NET team is integrating SAST into their CI/CD pipeline. They have a large legacy codebase with many existing vulnerabilities. The team wants to ensure that new code does not introduce new vulnerabilities while not being blocked by pre-existing issues. What is the most effective strategy?

Disable the SAST tool for the legacy codebase and only run it on new projects.

Fail the build on all findings, including pre-existing ones, to force the team to fix the entire legacy backlog immediately.

Configure the SAST tool to fail the build only on new findings introduced in the current change, while reporting pre-existing findings as warnings.

Run SAST only on the main branch and review findings after merge.

A .NET developer is explaining SAST to a new team member. The new member asks how SAST tools can detect SQL injection without running the application. What is the most accurate explanation?

SAST tools parse the source code and use data flow analysis to track user input from sources to SQL query sinks.

SAST tools use machine learning to predict which SQL queries are vulnerable based on historical data.

SAST tools execute the code in a sandbox and observe the SQL queries that are generated.

SAST tools inspect the compiled IL code to find SQL injection patterns.

What does a 'false positive' mean in the context of SAST scan results?

A vulnerability that is present but not exploitable

A real vulnerability that the tool failed to detect

A vulnerability that is fixed but still appears in the report

A reported vulnerability that does not actually exist in the code

In the context of SAST, what does data flow analysis primarily track?

The flow of data from sources to sinks to identify potential vulnerabilities

The order in which functions are called during execution

The memory usage of the application at runtime

The network connections established by the application

A .NET developer is evaluating a SAST tool for a new project. The project uses reflection and dynamic code generation extensively. The developer is concerned that the SAST tool may not detect vulnerabilities in dynamically generated code. What is the most accurate statement about SAST limitations in this context?

SAST can fully analyze dynamically generated code because it simulates runtime execution.

SAST will report all vulnerabilities in reflection-based code as false positives.

SAST may have limited visibility into code that is generated at runtime, potentially leading to false negatives.

SAST is not useful for projects that use reflection, so a different tool should be chosen.

EC-CouncilCertified Application Security Engineer (.NET)

Domain 8Objective 1

Static Application Security Testing (SAST) CASENET Practice Questions (Page 7)

Part of the Security Testing and Secure Deployment domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

7concepts

Questions 31–35

31expert · hard
A .NET team is integrating SAST into their CI/CD pipeline. They have a large legacy codebase with many existing vulnerabilities. The team wants to ensure that new code does not introduce new vulnerabilities while not being blocked by pre-existing issues. What is the most effective strategy?
Select an answer first
32application · medium
A .NET developer is explaining SAST to a new team member. The new member asks how SAST tools can detect SQL injection without running the application. What is the most accurate explanation?
Select an answer first
33foundation · easy
What does a 'false positive' mean in the context of SAST scan results?
Select an answer first
34foundation · easy
In the context of SAST, what does data flow analysis primarily track?
Select an answer first
35application · medium
A .NET developer is evaluating a SAST tool for a new project. The project uses reflection and dynamic code generation extensively. The developer is concerned that the SAST tool may not detect vulnerabilities in dynamically generated code. What is the most accurate statement about SAST limitations in this context?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.