Static Application Security Testing (SAST) CASENET Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   In a CI/CD pipeline, what is a common way to enforce security quality gates using SAST?

   • ARunning the SAST scan only on release branches
   • BDisabling the SAST scan to avoid slowing down the pipeline
   • CSending the SAST report to a manager for manual review after deployment
   • DFailing the build if the SAST scan finds vulnerabilities above a defined severity threshold
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which vulnerability class is characterized by untrusted data being written to a web page without proper encoding or validation?

   • ASQL injection
   • BCross-Site Scripting (XSS)
   • CSecurity misconfiguration
   • DInsecure deserialization
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A .NET development team runs a SAST scan on a legacy ASP.NET Web Forms application. The report flags a 'High' severity SQL injection in a data access layer method that concatenates user input into a SQL string. The team lead wants to confirm the finding before assigning it to a developer. What is the most appropriate next step?

   • AReview the data flow path from the user input source to the SQL query sink in the code and verify the input is not sanitized or parameterized.
   • BRe-run the scan with the default rule set to see if the finding disappears, indicating a false positive.
   • CImmediately patch the code by wrapping the concatenated string in an HTML-encode function to neutralize the vulnerability.
   • DMark the finding as 'Not Exploitable' in the SAST tool because the application is legacy and the code has been in production for years.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   After a SAST scan, a .NET developer receives a report with 50 findings. 40 are 'Low' severity, 8 are 'Medium', and 2 are 'High'. The team has limited time to remediate before a release. What is the most effective prioritization strategy?

   • AFix all 50 findings in the order they appear in the report to ensure nothing is missed.
   • BFix the 40 Low findings first because they are easier to fix and will reduce the total count quickly.
   • CMark all findings as false positives because the application has passed previous security reviews.
   • DFix the 2 High findings first, then the 8 Medium findings, and review the Low findings for false positives before deciding to fix them.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security team is configuring a SAST tool for a .NET solution that includes both web applications and internal class libraries. The organization's policy requires that all internet-facing web applications meet a stricter security standard than internal libraries. How should the SAST tool be configured to align with this policy?

   • ARun the SAST tool only on web application projects and skip internal libraries.
   • BConfigure the SAST tool to fail the build only on 'Critical' findings for all projects.
   • CCreate separate SAST profiles with different rulesets and severity thresholds, and assign each project to the appropriate profile.
   • DUse a single ruleset with the strictest settings for all projects to ensure maximum security.
   Reveal Solution Discussion Select an answer first