Static Application Security Testing (SAST) Concepts and Tools ECDE Practice Questions (Page 11)

Questions 51–53

1. 51application · medium

   A DevSecOps team has implemented SAST scanning in their CI pipeline. However, the security lead notices that some business-logic flaws, such as improper authorization checks, are not being caught by the SAST tool. What is the most effective way to address this gap?

   • AIncrease the frequency of SAST scans to catch more issues.
   • BReplace SAST with DAST to catch all types of vulnerabilities.
   • CConduct manual secure code reviews focusing on authorization and business logic.
   • DAdd more SAST rules to the tool to detect business-logic flaws.
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   A SAST scan of a web application reports a critical SQL injection vulnerability in a legacy module. The development team is unsure whether the finding is a true positive because the module is rarely used. What should the team do first?

   • AVerify the finding by reviewing the code path and confirming that user input reaches a SQL query without sanitization.
   • BSuppress the finding because the module is rarely used and the risk is low.
   • CIgnore the finding because SAST often produces false positives.
   • DImmediately deploy a fix to the module without further analysis.
   Reveal Solution Discussion Select an answer first
3. 53application · medium

   A development team uses GitLab CI/CD for a Python web application. They want to automatically fail the build when a new critical or high severity SAST finding is introduced, but allow the build to pass with warnings for medium and low findings. The SAST tool outputs a report in SARIF format. What is the most effective way to implement this requirement?

   • ARun SAST as a scheduled job outside the pipeline and manually review the report.
   • BParse the SARIF report in a custom script and fail the pipeline only if critical or high severity findings are present.
   • CUse the SAST tool's default configuration, which automatically fails builds on any finding.
   • DConfigure the SAST tool to exit with a non-zero code when any finding is found and use that as the build result.
   Reveal Solution Discussion Select an answer first