Static Application Security Testing (SAST) Concepts and Tools ECDE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which type of vulnerability is DAST more likely to detect than SAST?

   • ASQL injection vulnerabilities in source code
   • BUse of insecure cryptographic algorithms in code
   • CAuthentication and session management flaws that only appear during runtime
   • DHardcoded credentials in configuration files
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is a key weakness of automated SAST tools compared to manual code review?

   • AThey are unable to scan large codebases quickly
   • BThey may produce false positives that require human triage
   • CThey are more expensive than manual review
   • DThey cannot be integrated into development workflows
   Reveal Solution Discussion Select an answer first
4. 28application · easy

   A startup is developing a mobile application backend in Python. The team wants to identify security vulnerabilities as early as possible in the development lifecycle. They are considering when to run a SAST scan. Which point in the development process would provide the earliest meaningful feedback while still being practical?

   • AOnly during the annual security audit, to save on tooling costs.
   • BOnly when a security incident occurs, to identify the root cause.
   • COn every pull request, before the code is merged into the main branch.
   • DOnly after the code is deployed to production, to test the actual running environment.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is a common limitation of SAST tools?

   • AThey are unable to detect any security vulnerabilities
   • BThey may produce false positives that require manual review
   • CThey can only analyze compiled binaries, not source code
   • DThey require a running application to perform analysis
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A SAST scan of a web application reports a cross-site scripting (XSS) vulnerability in a function that outputs user input. The development team reviews the code and determines that the output is HTML-encoded before being rendered. The SAST tool does not recognize the encoding function as a sanitizer. What should the team do?

   • ARefactor the code to remove the encoding function and use a different output method.
   • BMark the finding as a false positive in the SAST tool and add the encoding function to the tool's sanitizer list so future scans recognize it.
   • CDisable the XSS rule in the SAST tool entirely to prevent similar false positives.
   • DIgnore the finding and do not document it, because the team knows the code is safe.
   Reveal Solution Discussion Select an answer first