Static and Dynamic Security Testing CT-STE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security tester is performing a dynamic test on a web application. The tester wants to identify vulnerabilities that require an authenticated user session, such as authorization flaws. The application uses a complex multi-step login process. Which tool feature is most important for this task?

   • AAbility to perform static data flow analysis on the source code.
   • BCapability to generate random inputs for fuzzing.
   • CIntegration with a runtime application self-protection (RASP) agent.
   • DSupport for scripting or recording login sequences to maintain authenticated sessions.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security tester needs to identify vulnerabilities in a web application that are only visible when the application is running with real user sessions and interacting with a backend database. The tester has access to a staging environment that mirrors production. Which technique is most appropriate?

   • AConduct a manual code review of the authentication module.
   • BUse a taint analysis tool to trace untrusted input through the code.
   • CPerform static analysis on the source code using a SAST tool.
   • DRun a dynamic application security testing (DAST) tool against the staging instance.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which tool is commonly used for dynamic application security testing (DAST)?

   • AFortify
   • BSonarQube
   • CCheckmarx
   • DOWASP ZAP
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security tester is comparing static and dynamic security testing to decide which to use for a particular project. The project is a legacy application with no source code available, but it is running in a production-like environment. The tester needs to identify vulnerabilities that are exploitable over the network. Which approach is most appropriate?

   • AUse static security testing (SAST) on the compiled binaries.
   • BUse taint analysis on the application's configuration files.
   • CPerform a manual code review of the application's documentation.
   • DUse dynamic security testing (DAST) against the running application.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A development team is about to merge a large feature branch into the main codebase. The security lead wants to catch injection and cross-site scripting (XSS) flaws early, before the code is deployed to a test environment. The team has limited time and cannot afford to set up a full runtime environment for this merge. Which approach best meets the requirement?

   • ADeploy the branch to a staging environment and run a dynamic application security testing (DAST) scan against the running application.
   • BPerform a manual code review focusing only on authentication logic.
   • CUse a fuzzing tool to send malformed inputs to the application's API endpoints.
   • DRun a static application security testing (SAST) tool on the branch and review the reported data-flow findings.
   Reveal Solution Discussion Select an answer first