Static Application Security Testing (SAST) Concepts and Tools ECDE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company is selecting a SAST tool for a codebase that is primarily written in Python and JavaScript. They have a requirement to integrate the tool with their Azure DevOps pipeline and need to enforce security gates. They are considering two tools: Tool A is a commercial tool with strong Python and JavaScript support but requires a separate server for the scanning engine. Tool B is an open-source tool that supports Python and JavaScript and can run as a container in the pipeline. Which factor should be the primary consideration in the selection?

   • AThe tool's licensing cost, because open-source tools are always free.
   • BThe tool's ability to integrate with Azure DevOps and enforce security gates in the pipeline.
   • CThe tool's user interface, because developers will use it daily.
   • DThe tool's reporting format, because PDF reports are required for compliance.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the typical first step in a remediation workflow after a SAST scan identifies a vulnerability?

   • ARewriting the entire application to eliminate all vulnerabilities
   • BTriaging the finding to confirm it is a real vulnerability
   • CIgnoring the finding if it is in a non-critical module
   • DDeploying the fix directly to production
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the purpose of rule sets in SAST tools?

   • ATo generate reports on the tool's performance
   • BTo specify the programming languages the tool can analyze
   • CTo define the patterns and coding practices that the tool checks for
   • DTo control the runtime environment in which the tool executes
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security team is reviewing SAST results for a web application and finds a high-severity finding that appears to be a false positive. The finding is in a function that processes user input, but the team believes the input is properly sanitized. What is the best way to handle this finding?

   • ASuppress the finding immediately because the team believes it is a false positive.
   • BIgnore the finding because SAST is known to produce false positives.
   • CIncrease the severity threshold to avoid seeing such findings in the future.
   • DManually verify the data flow to confirm whether the finding is a true positive or false positive.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security team runs a SAST scan on a Node.js web application and receives a report with 120 findings. The team triages the results and finds that 85 of the findings are in third-party library code that the application imports, 20 are in the application's own code, and 15 are configuration-related. The team wants to prioritize remediation efforts. Which finding category should the team address first, assuming the application's own code is the most security-sensitive?

   • AThe 20 findings in the application's own code, because they represent logic the development team directly controls and can fix.
   • BAll findings simultaneously, because SAST results should be remediated without prioritization.
   • CThe 15 configuration findings, because configuration issues are always the most critical to fix.
   • DThe 85 findings in third-party libraries, because they represent the largest volume of potential vulnerabilities.
   Reveal Solution Discussion Select an answer first