Integrating Secure Coding in the Code Stage DSE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A development team uses a SAST tool in the CI pipeline. The tool generates many false positives, and developers are starting to ignore its findings. What is the best way to improve the effectiveness of the SAST integration?

   • ARemove the SAST step from the pipeline to save time and reduce developer frustration.
   • BIncrease the severity threshold so that only critical findings are reported.
   • CRun SAST only on the main branch after merge instead of on every pull request.
   • DTune the SAST rules to the application's context and establish a process to triage and suppress confirmed false positives.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of output encoding?

   • ATo make the output more readable to humans
   • BTo encrypt the output to protect confidentiality
   • CTo compress the output to reduce bandwidth
   • DTo prevent the interpretation of user-controlled data as executable code in the output context
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A development team is building a REST API that accepts user-supplied JSON. A SAST scan flags that the API reflects user input into HTML responses without encoding. The team must fix this at the code stage. What is the most effective remediation?

   • ADisable the SAST rule for this finding because the API is consumed only by mobile clients.
   • BSwitch the API to return XML instead of JSON to avoid HTML encoding issues.
   • CAdd a global output-encoding filter that HTML-encodes all response data before it is sent to the client.
   • DAdd client-side input validation to the mobile app to prevent malicious payloads from being sent.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the benefit of integrating SAST into a CI/CD pipeline?

   • AIt eliminates the need for manual code reviews
   • BIt allows security testing to be performed automatically on every code change
   • CIt speeds up the compilation of the code
   • DIt guarantees that no vulnerabilities will be present in the final release
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company wants to integrate security testing into their CI/CD pipeline but has a constraint: the pipeline must not fail the build for non-critical issues, to avoid slowing down development. However, critical vulnerabilities must block the release. What is the best configuration?

   • ADo not fail the build for any security finding; only generate reports for manual review.
   • BFail the build for any security finding, regardless of severity.
   • CConfigure SAST and dependency scanning to fail the build only for critical or high-severity findings, and report medium/low findings as warnings.
   • DRun security scans only on the main branch after merge and fail the build if any finding is present.
   Reveal Solution Discussion Select an answer first