Understand the Usage and Concepts of Static Security Test Tools CT-STE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of static security test tools in the software development lifecycle?

   • ATo analyze source code without executing it to identify potential security vulnerabilities early in development.
   • BTo monitor production traffic and detect active attacks in real time.
   • CTo replace the need for manual code reviews and penetration testing entirely.
   • DTo execute the application and observe its behavior to find runtime security issues.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A static analysis tool is configured to detect buffer overflows in a C++ codebase. The tool uses a technique that examines the sequence of operations in each function to identify potential overflows. Which technique is this?

   • AData flow analysis
   • BControl flow analysis
   • CTaint analysis
   • DPattern matching
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A startup is building a new microservices-based application and wants to integrate security testing early in the development process. They have a small team and limited budget. Which approach would be most effective?

   • AUse a full-featured enterprise SAST tool with extensive customization
   • BPerform security testing only during a dedicated phase before release
   • CRely solely on external penetration testing after deployment
   • DUse a lightweight SAST tool integrated into the developers' IDE and CI pipeline
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst is reviewing a static analysis report for a Java application. The tool flagged a potential SQL injection vulnerability where user input flows from an HTTP request parameter into a SQL query without sanitization. Which static analysis technique is most likely responsible for this finding?

   • AControl flow analysis
   • BData flow analysis
   • CTaint analysis
   • DLexical analysis
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is reviewing a static analysis report and notices that the tool did not flag a known vulnerability in a third-party library that is used in the project. The analyst knows the library has a known CVE. What is the most likely reason for this gap?

   • AThe tool is not configured to detect that type of vulnerability
   • BThe vulnerability is not present in the version of the library used
   • CThe vulnerability is a false negative that cannot be detected by any static tool
   • DThe static analysis tool does not scan third-party dependencies
   Reveal Solution Discussion Select an answer first