Static Security Test Tools CT-STE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a common limitation of static analysis tools?

   • AThey may not detect vulnerabilities that depend on runtime behavior or external input
   • BThey require a running application to analyze
   • CThey are only useful for web applications
   • DThey can only analyze code written in a single programming language
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security tester is evaluating whether to use a SAST tool or a dependency scanner for a project that uses many open-source libraries. The main concern is known vulnerabilities in the libraries. Which tool is most appropriate?

   • AA dependency scanner
   • BA linter
   • CA code review tool
   • DA SAST tool
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security tester is explaining the limitations of static analysis to a project manager. Which statement accurately describes a limitation of static analysis?

   • AIt can detect vulnerabilities in third-party libraries, but it cannot analyze custom code.
   • BIt can detect runtime configuration issues, but it cannot analyze source code.
   • CIt cannot detect vulnerabilities that only manifest at runtime, such as race conditions.
   • DIt can detect all vulnerabilities in the code, but it requires a running application.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A team is developing a mobile application and wants to ensure that the code does not contain hardcoded API keys or insecure storage of sensitive data. They also want to enforce a consistent coding style. Which tool category is best suited for this task?

   • AA SAST tool with custom rules
   • BA linter
   • CA dependency scanner
   • DA runtime application self-protection (RASP) tool
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is a key benefit of using static security testing tools during development?

   • AThey eliminate the need for manual code reviews
   • BThey guarantee that all security vulnerabilities are found and fixed
   • CThey provide real-time protection against attacks in production
   • DThey can identify vulnerabilities in code that is not yet compiled or deployed
   Reveal Solution Discussion Select an answer first