Static Application Security Testing (SAST) CASENET Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   How do SAST tools analyze source code to detect vulnerabilities?

   • ABy parsing the code into an abstract syntax tree and performing data flow and control flow analysis
   • BBy monitoring network traffic between the application and its database
   • CBy sending malicious payloads to a running instance of the application
   • DBy executing the code with test inputs and observing outputs
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A security team is triaging SAST findings for a .NET application. The tool reports a 'High' severity finding for an insecure deserialization vulnerability in a method that deserializes data from a cookie. The team is unsure whether the finding is a true positive because the cookie data is encrypted. What is the most appropriate action?

   • AClose the finding as a false positive because the cookie is encrypted.
   • BInvestigate the data flow to determine if the encrypted cookie can be tampered with or if the decryption key is protected.
   • CIgnore the finding because the cookie is encrypted and cannot be modified by an attacker.
   • DImmediately fix the finding by adding a try-catch block around the deserialization call.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A .NET development team uses a SAST tool that supports custom rules. They want to enforce a company-specific rule that disallows the use of the 'DES' cryptographic algorithm. What is the most appropriate way to implement this requirement?

   • APerform a manual code search for 'DES' before each release.
   • BCreate a custom SAST rule that flags any usage of DES in the codebase and add it to the rule set used in CI.
   • CRely on the SAST tool's default rule set, which already includes a rule for weak cryptography.
   • DAdd a comment in the code style guide that DES should not be used.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A SAST report flags a 'Critical' finding for a command injection vulnerability in a .NET application. The code uses Process.Start with a string that includes user input. The team lead wants to confirm the finding before remediation. What is the most appropriate action?

   • ARun the application and test the command injection manually to see if it works.
   • BChange the severity to 'Medium' because the application runs in a restricted environment.
   • CTrace the user input from its source to the Process.Start call to verify that it is not validated or sanitized.
   • DIgnore the finding because Process.Start is a common .NET API and the tool often generates false positives.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Why is it important to customize SAST rulesets to match your organization's technology stack and security requirements?

   • ATo reduce false positives and focus on vulnerabilities relevant to your application
   • BTo ensure the SAST tool can compile the source code
   • CTo allow the SAST tool to access the production database
   • DTo make the SAST tool run faster by skipping all security checks
   Reveal Solution Discussion Select an answer first