Static and Dynamic Security Testing CT-STE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security team is evaluating the strengths and limitations of static and dynamic testing to plan their testing strategy. They have a critical application that must be highly available, and they cannot afford any downtime for testing. The team has access to the source code. Which testing approach is most appropriate to avoid downtime?

   • AUse fuzzing against the production environment.
   • BUse runtime application self-protection (RASP) to test the application.
   • CUse static security testing (SAST) on the source code.
   • DUse dynamic security testing (DAST) against the production environment.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security team is integrating security testing into a CI/CD pipeline for a web application. The team wants to catch vulnerabilities early, but they also need to avoid slowing down the pipeline significantly. They have a limited budget and cannot afford expensive commercial tools. Which strategy best balances early detection and pipeline performance?

   • ARun a comprehensive SAST scan on every commit and skip DAST entirely.
   • BRun a full DAST scan on every commit in the production environment.
   • CRun a fuzzing tool on every commit in the build stage.
   • DRun a fast SAST scan on every commit and a more comprehensive DAST scan nightly on the staging environment.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A development team is adopting a DevSecOps approach. They want to integrate security testing into their CI/CD pipeline to catch vulnerabilities as early as possible, but they also want to catch runtime issues that only appear in a deployed environment. Which combination of testing techniques best achieves this goal?

   • ARun only DAST in the production environment.
   • BRun fuzzing in the build stage before compilation.
   • CRun only SAST in the build stage.
   • DRun SAST in the build stage and DAST in the staging environment.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security tester is evaluating a web application that handles file uploads. The tester wants to discover unexpected behavior when malformed or unexpected files are uploaded. The application is already running in a test environment. Which technique is most appropriate?

   • AUse a taint analysis tool to trace file upload data through the code.
   • BUse a fuzzing tool to send a variety of malformed file inputs to the upload endpoint.
   • CPerform a manual code review of the file upload validation logic.
   • DRun a SAST tool on the source code to look for file upload vulnerabilities.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which statement best defines static security testing?

   • ATesting that analyzes the application's source code or binaries without executing it to identify potential security weaknesses.
   • BTesting that monitors the application's runtime behavior to detect and block attacks in real time.
   • CTesting that uses automated tools to simulate attacks against a deployed application.
   • DTesting that executes the application to identify vulnerabilities in a running environment.
   Reveal Solution Discussion Select an answer first