App Security Engineer Secure Deployment Flashcards

In a CI/CD pipeline, at which point is Static Application Security Testing (SAST) most effectively integrated?

Answer: During code commit or build stages

Running SAST at commit or build time finds code flaws early, when they are cheapest to fix.

What is the key difference between DAST and SAST when validating a deployment?

Answer: DAST tests the running application from outside; SAST analyzes code without executing it

DAST is black-box testing of a running deployment, while SAST is white-box analysis of source or bytecode.

A team uses a Web Application Firewall in front of a vulnerable legacy app while a code fix is developed. What is this approach called?

Answer: Virtual patching

Virtual patching uses WAF rules to block exploitation of a known flaw until the code is fixed.

Which artifact lists all components and dependencies of a deployed application so known vulnerabilities can be tracked?

Answer: Software Bill of Materials (SBOM)

An SBOM inventories components so teams can quickly match them against new CVEs.

Why should release artifacts be digitally signed before deployment?

Answer: To verify integrity and authenticity so tampered builds are rejected

Code signing lets deployment systems confirm an artifact came from a trusted source and was not modified.

Which TLS configuration is most appropriate for a newly deployed public web application?

Answer: Allow only TLS 1.2 and 1.3 with strong AEAD cipher suites

Older protocols and weak ciphers have known attacks such as POODLE and BEAST, so only modern TLS should be enabled.

What is the security benefit of removing sample applications and unused modules from a production application server?

Answer: It reduces the attack surface

Sample apps and unused modules often contain known vulnerabilities, so removing them shrinks what attackers can target.