Static Application Security Testing (SAST) Concepts and Tools ECDE Practice Questions (Page 2)

Questions 6–10

1. 6application · easy

   A security team is designing a testing strategy for a web application. They want to detect vulnerabilities that only manifest at runtime, such as authentication bypasses that depend on the application's state or configuration. Which testing approach should they use?

   • AA manual code review, because it can identify all runtime issues by reading the code.
   • BSAST, because it analyzes the source code and can find all vulnerabilities.
   • CA dependency scanner, because it checks for known vulnerabilities in third-party libraries.
   • DDAST, because it tests the running application and can detect runtime-dependent vulnerabilities.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security engineer is explaining to a developer why a SAST scan did not detect a cross-site scripting (XSS) vulnerability that was later found in production. The vulnerability only occurs when the application is used with a specific browser configuration. What is the most likely reason SAST missed it?

   • ASAST analyzes source code without executing it, so it cannot detect runtime-dependent behaviors like browser-specific rendering.
   • BThe developer did not run SAST on the correct branch.
   • CSAST is only designed to detect SQL injection, not XSS.
   • DThe SAST tool was not configured with the correct browser emulation settings.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of Static Application Security Testing (SAST) in the software development lifecycle?

   • ATo monitor production logs for security incidents and anomalies
   • BTo perform penetration testing on the deployed application to find exploitable weaknesses
   • CTo analyze source code for security vulnerabilities without executing the application
   • DTo test the running application for vulnerabilities by sending malicious inputs
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security team is implementing a secure code review process. They have an automated SAST tool that scans every commit. The team wants to add a manual code review step that complements the SAST results. Which manual review activity would provide the most value beyond what the SAST tool already detects?

   • ARe-running the SAST scan with a different rule set to see if additional issues appear.
   • BChecking the code for syntax errors and compilation warnings.
   • CReviewing the business logic for authorization flaws, such as missing role checks in a multi-tenant application.
   • DVerifying that the code follows the team's naming conventions and formatting standards.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A team is deciding how to allocate security review effort for a critical payment processing module. They have a SAST tool that scans the code, but they are considering adding a manual code review. The team has limited time and wants to maximize the value of the manual review. Which focus area would provide the most benefit beyond the SAST scan?

   • AReviewing the payment amount calculation logic for integer overflow or rounding errors that could lead to financial loss.
   • BChecking the code for proper indentation and naming conventions.
   • CVerifying that all functions have unit tests with at least 80% coverage.
   • DRe-running the SAST scan with a different rule set to check for additional injection patterns.
   Reveal Solution Discussion Select an answer first