Static Application Security Testing (SAST) Concepts and Tools ECDE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A DevSecOps team is integrating a SAST tool into their CI pipeline. The tool produces a large number of false positives, and developers are starting to ignore the scan results. The team wants to improve the effectiveness of the SAST process without losing visibility into real issues. Which action should the team take first?

   • ADisable the SAST tool entirely and rely on manual code reviews.
   • BAsk developers to fix all findings, including false positives, to keep the report clean.
   • CIncrease the severity threshold so only critical findings are reported.
   • DEstablish a formal triage process where a security champion reviews each finding, marks confirmed false positives, and documents the reason for suppression.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is a widely used SAST tool?

   • AWireshark
   • BBurp Suite
   • CSonarQube
   • DNessus
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A development team is building a REST API that handles user authentication. They run a SAST scan and a DAST scan. The SAST scan reports a potential SQL injection in a database query, while the DAST scan does not detect it. The team is confused about why the DAST scan missed it. Which is the most likely reason?

   • AThe SAST scan reported a false positive, and the DAST scan correctly showed there is no vulnerability.
   • BThe DAST scan only detects vulnerabilities in the frontend, not in the backend database layer.
   • CThe SAST scan is always more accurate than DAST, so the DAST result is irrelevant.
   • DThe DAST scan did not send a payload that triggered the vulnerable code path, because the injection requires a specific input format or authentication state.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary benefit of integrating SAST into the CI/CD pipeline?

   • AIt automatically fixes all identified vulnerabilities
   • BIt eliminates the need for manual code reviews
   • CIt ensures that no vulnerabilities are present in the final release
   • DIt provides early and continuous feedback on security issues to developers
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A DevSecOps engineer is configuring a CI/CD pipeline for a Java Spring Boot application. The team wants to fail the build only when a critical or high-severity vulnerability is found in the new code committed in the pull request, while allowing existing medium-severity issues in legacy code to remain visible in the report without blocking the pipeline. The SAST tool supports incremental scanning and quality gates. Which configuration approach should the engineer use?

   • ARun a full scan on every commit and configure the quality gate to fail on any issue with a severity of medium or higher.
   • BRun a full scan only on the main branch and use a separate manual review process for pull requests.
   • CDisable the quality gate and rely on developers to manually review the SAST report after the build completes.
   • DEnable incremental scan on pull requests and set the quality gate to fail on any new critical or high-severity issue, while reporting all issues regardless of origin.
   Reveal Solution Discussion Select an answer first