CASE App Security Engineer Secure Deployment 4

Question 1

In a CI/CD pipeline, at which point is Static Application Security Testing (SAST) most effectively integrated?

Accepted Answer

During code commit or build stages

Answer

Running SAST at commit or build time finds code flaws early, when they are cheapest to fix.

Question 2

What is the key difference between DAST and SAST when validating a deployment?

Accepted Answer

DAST tests the running application from outside; SAST analyzes code without executing it

Answer

DAST is black-box testing of a running deployment, while SAST is white-box analysis of source or bytecode.

Question 3

A team uses a Web Application Firewall in front of a vulnerable legacy app while a code fix is developed. What is this approach called?

Accepted Answer

Virtual patching

Answer

Virtual patching uses WAF rules to block exploitation of a known flaw until the code is fixed.

Question 4

Which artifact lists all components and dependencies of a deployed application so known vulnerabilities can be tracked?

Accepted Answer

Software Bill of Materials (SBOM)

Answer

An SBOM inventories components so teams can quickly match them against new CVEs.

Question 5

Why should release artifacts be digitally signed before deployment?

Accepted Answer

To verify integrity and authenticity so tampered builds are rejected

Answer

Code signing lets deployment systems confirm an artifact came from a trusted source and was not modified.

(CASE) Certified Application Security Engineer Practice Test