Static Application Security Testing (SAST) Concepts and Tools ECDE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A DevSecOps team wants to ensure that SAST findings are not ignored by developers. They plan to integrate SAST into their CI pipeline and want to enforce a policy where critical and high findings must be fixed before a merge. What is the best way to implement this?

   • ARun SAST only on the main branch and review findings manually.
   • BConfigure the CI pipeline to fail the build if critical or high severity findings are present.
   • CUse a SAST tool that only reports critical findings.
   • DSend an email report to the security team after each scan.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a best practice for managing false positives in SAST results?

   • ARegularly review and tune the rule set to reduce false positives
   • BDisable all SAST rules to avoid false positives
   • CAutomatically deploy code that passes SAST without manual review
   • DIgnore all findings that are not confirmed by a second tool
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security team is triaging SAST findings for a web application. The scan reports a critical-severity SQL injection in a function that is called from a public-facing endpoint. The team also finds a medium-severity XSS issue in an internal admin panel that is only accessible to authenticated administrators. The team has limited resources and can only fix one issue this sprint. Which issue should the team fix first?

   • AThe medium XSS in the admin panel, because it is in an internal system.
   • BNeither issue, because SAST findings are often false positives.
   • CThe critical SQL injection, because it is in a public-facing endpoint and has a higher severity rating.
   • DBoth issues simultaneously, because both are security vulnerabilities.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A DevSecOps team is deciding how to allocate limited security review resources between automated SAST and manual code review. The application is a customer-facing web app with high regulatory requirements. The team has found that SAST catches common issues but misses business-logic flaws. What is the most effective allocation of resources?

   • AUse manual review for all code changes and skip SAST to avoid false positives.
   • BUse SAST for all code changes and allocate manual review to critical business-logic modules.
   • CUse both SAST and manual review for every code change to maximize coverage.
   • DUse SAST only for new features and manual review only for bug fixes.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security team is evaluating SAST tools for a Ruby on Rails application. They need a tool that can be easily integrated into their GitHub Actions workflow and provides a simple way to report findings to developers. Which tool is most appropriate?

   • ABrakeman
   • BFindBugs
   • CBandit
   • DESLint
   Reveal Solution Discussion Select an answer first