Static Application Security Testing (SAST) Concepts and Tools ECDE Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which statement correctly distinguishes SAST from DAST?

   • ASAST is performed after deployment, while DAST is performed during development.
   • BSAST tests the application from the outside, while DAST analyzes the source code.
   • CSAST analyzes source code without executing it, while DAST tests the running application from the outside.
   • DSAST detects runtime issues, while DAST detects code-level vulnerabilities.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A company has a polyglot codebase with Java, JavaScript, and Python services. They want a single SAST tool that can analyze all three languages, integrate with their Jenkins pipeline, and provide a unified dashboard for security metrics. Which tool capability is most important to evaluate first?

   • AThe tool's integration with Jenkins.
   • BThe tool's reporting format and dashboard customization options.
   • CThe tool's pricing model and licensing costs.
   • DThe tool's ability to parse and analyze multiple programming languages.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   At which stage of the software development lifecycle is SAST most effectively applied to identify vulnerabilities early?

   • ADuring the penetration testing phase, after the application is fully deployed
   • BDuring the production monitoring phase, after the application is live
   • CDuring the requirements gathering phase, before any code is written
   • DDuring the coding and build phase, before the application is deployed
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A security team is designing a testing strategy for a critical web application. They have a SAST tool that scans the source code and a DAST tool that scans the running application. The team wants to detect a vulnerability that only occurs when a specific sequence of user actions is performed, such as a multi-step workflow that leads to an authorization bypass. Which testing approach is most likely to detect this vulnerability?

   • ADAST, because it can be configured to execute a multi-step workflow and observe the application's responses at each step.
   • BSAST, because it analyzes the source code and can trace the data flow through the multi-step workflow.
   • CA manual code review, because it can trace the logic of the multi-step workflow by reading the code.
   • DA dependency scanner, because it can identify known vulnerabilities in the libraries used by the application.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   How does secure code review complement automated SAST scanning?

   • AIt runs the application to test for runtime vulnerabilities
   • BIt can catch logic flaws and business logic issues that SAST tools may miss
   • CIt automatically fixes all vulnerabilities found by SAST
   • DIt replaces the need for SAST scanning entirely
   Reveal Solution Discussion Select an answer first