Static and Dynamic Security Testing CT-STE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security team is planning a testing strategy for a new web application. They want to catch coding flaws early in the development cycle and also identify runtime configuration issues before release. The team has limited budget and wants to use a single tool that can address both needs. Which approach is most effective?

   • AUse only a SAST tool throughout the entire development lifecycle.
   • BUse a fuzzing tool on the source code before compilation.
   • CUse only a DAST tool in the production environment.
   • DUse a SAST tool during development and a DAST tool during staging.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which practice best integrates static and dynamic security testing into the development process?

   • ARunning static analysis only after the application is deployed to production.
   • BUsing dynamic testing only during the requirements phase.
   • CRunning static analysis in the CI/CD pipeline and dynamic testing against staging or test environments.
   • DPerforming both static and dynamic testing only during the maintenance phase.
   Reveal Solution Discussion Select an answer first
4. 3foundation · medium

   During which phase of the software development lifecycle (SDLC) is dynamic security testing most commonly performed, and what is its primary purpose?

   • ADuring the design phase, to review architectural diagrams for potential security flaws before any code is written.
   • BDuring the testing phase, to evaluate the security of a running application by simulating real-world attacks.
   • CDuring the requirements phase, to validate that security requirements are testable and complete.
   • DDuring the coding phase, to analyze source code for vulnerabilities as it is being written.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security team is integrating security testing into a CI/CD pipeline for a microservices application. The team wants to catch vulnerabilities early, but they also need to ensure that the testing does not introduce significant delays in the pipeline. They have a limited budget and cannot afford to run expensive tools on every build. Which strategy best balances early detection, pipeline performance, and cost?

   • ARun a DAST scan on every build in the production environment.
   • BRun a fuzzing tool on every build in the build stage.
   • CRun a lightweight SAST scan on every build and a comprehensive DAST scan on a nightly schedule.
   • DRun a comprehensive SAST scan on every build and skip DAST entirely.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   How do static and dynamic security testing complement each other in the development process?

   • AStatic testing identifies runtime issues, while dynamic testing identifies code-level issues.
   • BStatic testing finds vulnerabilities early in the SDLC, while dynamic testing finds issues that only appear at runtime.
   • CStatic testing is used only for web applications, while dynamic testing is used for all other applications.
   • DStatic testing is automated, while dynamic testing is always manual.
   Reveal Solution Discussion Select an answer first