Static Application Security Testing (SAST) Concepts and Tools ECDE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is a key capability of SAST tools?

   • ACapability to simulate real-world attacks against the deployed application
   • BAbility to test the application's runtime behavior under load
   • CSupport for multiple programming languages and frameworks
   • DIntegration with production monitoring tools to detect live threats
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which practice helps align SAST with development workflows?

   • AHaving security experts manually run SAST after each release
   • BRunning SAST only once before release
   • CUsing SAST only for code written by senior developers
   • DIntegrating SAST into the IDE and CI/CD pipeline for early feedback
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A development team is implementing a secure code review process. They have a SAST tool that scans every commit and a manual review process that is performed by senior developers. The team is debating how to allocate review effort. The SAST tool has a high false-positive rate, and the senior developers are spending too much time reviewing false positives. Which approach would best improve the efficiency of the manual review process?

   • ADisable the SAST tool and rely entirely on manual code review by senior developers.
   • BHave the SAST tool automatically suppress findings that match a predefined false-positive pattern, and have the senior developers review only the remaining findings.
   • CIncrease the severity threshold so that only critical findings are reported, and have senior developers review only those.
   • DHave the senior developers review all findings, including false positives, to ensure nothing is missed.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A security team is evaluating the results of a SAST scan on a legacy Java application. The scan reports 500 findings, of which 400 are in code that is no longer actively maintained, and 100 are in actively developed code. The team has limited remediation resources and wants to reduce risk most effectively. The application is scheduled to be replaced in 12 months. Which approach should the team take?

   • APrioritize the 100 findings in actively developed code, and document the 400 findings in legacy code as accepted risk with a review date.
   • BRemediate all 500 findings immediately, regardless of the code's activity level.
   • CFocus on the 400 legacy findings because they represent the largest volume of potential vulnerabilities.
   • DDisable the SAST tool for legacy code to reduce the number of reported findings.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A DevSecOps team is struggling with a high volume of SAST findings, many of which are false positives. Developers are becoming desensitized and may ignore real issues. The team wants to reduce noise without losing true positives. What is the most effective strategy?

   • ASwitch to a different SAST tool that has a lower false-positive rate.
   • BDisable SAST for the modules with the most false positives.
   • CTune the SAST rules to match the application's framework and suppress known false-positive patterns with justification.
   • DIncrease the severity threshold so only critical findings are reported.
   Reveal Solution Discussion Select an answer first