Static Application Security Testing (SAST) Concepts and Tools ECDE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A large organization has multiple development teams using different CI/CD platforms (Jenkins, GitLab CI, and Azure DevOps). They want to enforce a consistent SAST policy across all teams, including severity thresholds and reporting. The security team has limited resources and cannot maintain custom integrations for each platform. What is the most effective approach?

   • ACreate a custom script that runs SAST and uploads results to a central server for each platform.
   • BRequire all teams to migrate to a single CI/CD platform to simplify integration.
   • CRun SAST only in a centralized security team's environment and share reports manually.
   • DUse a SAST tool that provides native plugins for all three CI/CD platforms and centralize policy management in the tool.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A DevSecOps engineer is designing a security testing strategy for a Java microservices application. The team wants to catch vulnerabilities as early as possible in the development cycle, but they also need to identify issues that only manifest when the application is running, such as authentication bypasses and insecure server configuration. Which combination of testing approaches best meets both requirements?

   • ARun DAST only in the CI pipeline and skip SAST because DAST covers all vulnerability classes earlier.
   • BRun DAST in the CI pipeline on every commit and schedule SAST against the production environment weekly.
   • CRun SAST in the CI pipeline on every commit and schedule DAST against a staging environment after deployment.
   • DRun SAST only in the CI pipeline and skip DAST because SAST can detect all vulnerability classes.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   When prioritizing SAST findings, which factor should be considered first?

   • AThe name of the developer who wrote the code
   • BThe color of the alert in the tool
   • CThe line number where the issue was found
   • DThe severity of the vulnerability
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is a key strength of manual code review compared to automated SAST tools?

   • AIt produces consistent results with no human error
   • BIt can be easily integrated into CI/CD pipelines
   • CIt is faster and can scan large codebases in seconds
   • DIt can understand business logic and detect complex logical vulnerabilities
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A SAST scan reports a critical finding in a third-party library that is used across multiple applications. The library is no longer maintained, and the team cannot upgrade to a patched version. What is the most appropriate remediation workflow?

   • AIgnore the finding because SAST often reports false positives in third-party code.
   • BDocument the risk, implement compensating controls (e.g., WAF rules, input validation), and schedule a migration to an alternative library.
   • CSuppress the finding because the library is third-party and not the team's code.
   • DImmediately remove the library from all applications.
   Reveal Solution Discussion Select an answer first