Static Application Security Testing (SAST) Concepts and Tools ECDE Practice Questions (Page 10)

Questions 46–50

1. 46application · easy

   A company has a large codebase written in Java, C#, and JavaScript. They are evaluating SAST tools and want a single tool that can scan all three languages, integrate with their Jenkins CI server, and provide a centralized reporting dashboard. Which tool selection would best meet these requirements?

   • ABandit, because it is a popular Python SAST tool that integrates with Jenkins.
   • BESLint, because it is a widely used JavaScript linter with security rules.
   • CSonarQube, because it supports multiple languages, has Jenkins integration, and provides a centralized web dashboard for quality and security reports.
   • DA custom script that runs grep for common vulnerability patterns in all three languages.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   How are SAST tools typically integrated into a CI/CD pipeline to automate security checks?

   • AAs a step in the pipeline that runs on every code commit or build
   • BAs a tool that runs only during the deployment phase to check the final build
   • CAs a manual step performed by security engineers after each release
   • DAs a separate system that scans the production environment periodically
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which type of security issue is SAST generally unable to detect?

   • AUse of insecure cryptographic algorithms in source code
   • BRuntime configuration errors that only appear when the application is running
   • CHardcoded credentials in source code
   • DSQL injection vulnerabilities in database queries
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A company is evaluating SAST tools for a large codebase that includes C++, Java, and JavaScript. They need a tool that can be integrated into their existing CI/CD pipeline and provide detailed reports for compliance audits. The security team is concerned about the tool's ability to handle large codebases without slowing down the pipeline. Which feature is most important to evaluate?

   • AThe tool's integration with the CI/CD pipeline.
   • BThe tool's scalability and performance on large codebases.
   • CThe tool's support for multiple languages.
   • DThe tool's reporting capabilities for compliance audits.
   Reveal Solution Discussion Select an answer first
6. 50application · easy

   A DevSecOps team is selecting a SAST tool for a polyglot codebase that includes Python, Go, and Ruby. They need the tool to integrate with their GitLab CI pipeline and provide a way to enforce security gates. Which tool capability is most important to verify before making the selection?

   • AThe tool can generate a PDF report for compliance documentation.
   • BThe tool has a command-line interface that can be run manually on a developer's machine.
   • CThe tool has a free tier that supports unlimited users.
   • DThe tool supports all three languages (Python, Go, and Ruby) and provides a GitLab CI plugin or API for integration.
   Reveal Solution Discussion Select an answer first