Static Application Security Testing (SAST) Concepts and Tools ECDE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is the primary purpose of a secure code review?

   • ATo identify security vulnerabilities and weaknesses in the code before it is deployed
   • BTo improve the performance of the application
   • CTo document the code for future maintenance
   • DTo test the application's user interface for usability issues
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security team is evaluating SAST results for a legacy Java application. The SAST tool reports a high number of findings in a module that handles user input, but many are flagged as 'potential' issues. The team is concerned about wasting developer time on false positives. What is the best approach to handle this situation?

   • ATriage the findings manually, mark confirmed issues as true positives, and suppress or annotate false positives with justification.
   • BDisable the rules that generate the most findings to reduce noise.
   • CIgnore all findings because SAST is known to produce too many false positives.
   • DSwitch to a different SAST tool that reports fewer findings.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A startup with a small development team wants to improve code security without slowing down development. They are considering whether to rely on automated SAST tools or manual code reviews. What is the most balanced approach?

   • AUse both SAST and manual review for every commit to maximize coverage.
   • BUse manual review for every commit and skip SAST to avoid false positives.
   • CUse SAST for every commit and manual review only for critical modules.
   • DUse SAST only before major releases and manual review for all other changes.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A development team is integrating SAST into their CI pipeline. They want to ensure that developers receive feedback quickly, but the full SAST scan takes 30 minutes. The team is considering running SAST on every commit. What is the best approach to balance speed and coverage?

   • ARun SAST on changed files for each commit and run a full scan on the main branch nightly.
   • BRun SAST only on the main branch after merge to avoid delays.
   • CRun SAST on every commit with a reduced rule set to speed up the scan.
   • DRun SAST only on release branches to minimize scan time.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which SAST tool is known for its ability to scan source code and identify security vulnerabilities in multiple programming languages, and is often used in enterprise environments?

   • ANmap
   • BMetasploit
   • COpenVAS
   • DCheckmarx
   Reveal Solution Discussion Select an answer first