SAST & DAST Vocabulary
Practice vocabulary for SAST, DAST, IAST, SCA, and security finding terminology used in DevSecOps pipelines.
0 / 45 completed
1 / 45
What does SAST stand for and how does it work?
SAST (Static Application Security Testing) inspects source code, bytecode, or compiled binaries for security issues — SQL injection patterns, hardcoded credentials, unsafe function calls — without running the application. Tools include Semgrep, SonarQube, CodeQL, and Checkmarx.
2 / 45
What is DAST and how does it differ from SAST?
DAST (Dynamic Application Security Testing) attacks a live, running application — sending fuzzing inputs, scanning for XSS, SQLi, and authentication flaws — without access to source code. Tools include OWASP ZAP, Burp Suite, and Nuclei. SAST is white-box (has code access); DAST is black-box (no code access).
3 / 45
What is SCA (Software Composition Analysis) in a security context?
SCA (Software Composition Analysis) identifies open-source libraries and dependencies in a project and checks them against CVE databases. Tools include Dependabot, Snyk Open Source, OWASP Dependency-Check, and Renovate. SCA is distinct from SAST (which analyses your own code) and DAST (which tests the running app).
4 / 45
In security testing, what is a 'true positive' vs. a 'false positive'?
A true positive is a real security finding — the tool correctly identified a vulnerability. A false positive is a spurious alert — the code is actually safe but the tool flagged it. High false positive rates degrade trust in security tooling. Teams triage findings to confirm true positives and suppress confirmed false positives.
5 / 45
What does it mean to 'suppress' a false positive in a SAST tool?
Suppressing a false positive marks a specific finding as intentionally ignored — e.g., via a code annotation (`// nosec`, `@SuppressWarnings`), a findings-management config file, or the tool's UI. Good practice requires a justification explaining why the finding is not a real risk. Suppressions should be reviewed periodically.
6 / 45
Alex: "Hey team, I've flagged a potential vulnerability in the new user registration endpoint. The SAST tool is reporting a possible SQL injection risk on the 'email' parameter. Should we immediately deploy this PR or investigate further?"This scenario highlights the importance of critical thinking during code reviews. Simply accepting a SAST report as definitive is often premature—false positives are common. The correct response involves investigating the specific details of the reported vulnerability to determine its validity before making any deployment decisions. Prioritizing based solely on the tool's output without considering other factors (like severity, context, and potential false positives) can lead to wasted effort.
7 / 45
Sarah: 'I've just submitted this PR for the payment processing module. The SAST tool highlighted several potential issues – including a missing input validation on the 'amount' field and a possible XSS vulnerability in the display of transaction details. I've marked all these as 'false positives' to avoid blocking my work. What is the *most* appropriate next step for David, the security engineer, to take?While it's good practice to manage false positives, blindly marking issues as such without understanding *why* the SAST tool flagged them is dangerous. David should first understand Sarah's rationale – was there a legitimate reason for the lack of validation or potential XSS? He needs to verify that the findings are truly false and not masking a genuine vulnerability before allowing the PR to proceed, ensuring proper security practices are followed.
8 / 45
The team is reviewing a PR for a new API endpoint. The DAST tool has identified several potential vulnerabilities, including a lack of rate limiting and insufficient output encoding. David, the security engineer, needs to prioritize these findings. Which action demonstrates the *most* effective approach to addressing these DAST results?
This scenario highlights the practical application of DAST in a code review context. Prioritizing remediation based on severity scores allows David to focus on the most critical vulnerabilities first, minimizing immediate risk. This approach combines proactive security with efficient development workflow – a key element of modern software security practices. Ignoring or dismissing DAST findings without investigation is a dangerous oversimplification.
9 / 45
During a code review for the user profile service, Liam notes that the SAST tool flagged a potential use of deprecated cryptography libraries. The report suggests upgrading to the latest versions to mitigate risks associated with known vulnerabilities. However, upgrading requires significant refactoring and testing. Which statement best reflects Liam's approach to this finding?
Liam: 'Okay, I'll just mark this as a false positive and move on. It's not directly impacting any critical functionality.'
Liam: 'Okay, I'll just mark this as a false positive and move on. It's not directly impacting any critical functionality.'
This scenario highlights the importance of understanding the severity of SAST findings. A 'true' false positive might be acceptable for low-risk issues, but a deprecated cryptography library directly impacts security and represents an *urgent* vulnerability that needs to be addressed. Marking it as simply 'false' without further investigation is a missed opportunity to strengthen the application's defenses.
10 / 45
The team is discussing a DAST report highlighting potential vulnerabilities in the authentication service. The report indicates a lack of proper escaping of user input before it's used to construct database queries. One developer suggests simply adding a blanket `htmlspecialchars()` filter to all input fields. Another argues for more targeted sanitization based on the specific query parameters. Which approach is most aligned with a secure development practice, considering the potential for complex vulnerabilities?
This question tests understanding of nuanced vulnerability mitigation. While `htmlspecialchars()` can address some XSS issues, it's often not sufficient for preventing SQL injection attacks. Targeted sanitization – specifically, using parameterized queries or prepared statements – ensures that user input is treated as data and not as executable code, which is the core principle behind preventing database vulnerabilities. A blanket filter may miss specific attack vectors.
11 / 45
Alex: "Hey team, I've flagged a potential vulnerability in the new user registration endpoint. The SAST tool is reporting a possible SQL injection risk on the 'email' parameter. Should we immediately deploy this PR or investigate further?"This scenario highlights the importance of critical thinking during code reviews. Simply accepting a SAST report as definitive is often premature—false positives are common. The correct response involves investigating the specific details of the reported vulnerability to determine its validity before making any deployment decisions. Prioritizing based solely on the tool's output without considering other factors (like severity, context, and potential false positives) can lead to wasted effort.
12 / 45
Sarah: 'I've just submitted this PR for the payment processing module. The SAST tool highlighted several potential issues – including a missing input validation on the 'amount' field and a possible XSS vulnerability in the display of transaction details. I've marked all these as 'false positives' to avoid blocking my work. What is the *most* appropriate next step for David, the security engineer, to take?While it's good practice to manage false positives, blindly marking issues as such without understanding *why* the SAST tool flagged them is dangerous. David should first understand Sarah's rationale – was there a legitimate reason for the lack of validation or potential XSS? He needs to verify that the findings are truly false and not masking a genuine vulnerability before allowing the PR to proceed, ensuring proper security practices are followed.
13 / 45
The team is reviewing a PR for a new API endpoint. The DAST tool has identified several potential vulnerabilities, including a lack of rate limiting and insufficient output encoding. David, the security engineer, needs to prioritize these findings. Which action demonstrates the *most* effective approach to addressing these DAST results?
This scenario highlights the practical application of DAST in a code review context. Prioritizing remediation based on severity scores allows David to focus on the most critical vulnerabilities first, minimizing immediate risk. This approach combines proactive security with efficient development workflow – a key element of modern software security practices. Ignoring or dismissing DAST findings without investigation is a dangerous oversimplification.
14 / 45
During a code review for the user profile service, Liam notes that the SAST tool flagged a potential use of deprecated cryptography libraries. The report suggests upgrading to the latest versions to mitigate risks associated with known vulnerabilities. However, upgrading requires significant refactoring and testing. Which statement best reflects Liam's approach to this finding?
Liam: 'Okay, I'll just mark this as a false positive and move on. It's not directly impacting any critical functionality.'
Liam: 'Okay, I'll just mark this as a false positive and move on. It's not directly impacting any critical functionality.'
This scenario highlights the importance of understanding the severity of SAST findings. A 'true' false positive might be acceptable for low-risk issues, but a deprecated cryptography library directly impacts security and represents an *urgent* vulnerability that needs to be addressed. Marking it as simply 'false' without further investigation is a missed opportunity to strengthen the application's defenses.
15 / 45
The team is discussing a DAST report highlighting potential vulnerabilities in the authentication service. The report indicates a lack of proper escaping of user input before it's used to construct database queries. One developer suggests simply adding a blanket `htmlspecialchars()` filter to all input fields. Another argues for more targeted sanitization based on the specific query parameters. Which approach is most aligned with a secure development practice, considering the potential for complex vulnerabilities?
This question tests understanding of nuanced vulnerability mitigation. While `htmlspecialchars()` can address some XSS issues, it's often not sufficient for preventing SQL injection attacks. Targeted sanitization – specifically, using parameterized queries or prepared statements – ensures that user input is treated as data and not as executable code, which is the core principle behind preventing database vulnerabilities. A blanket filter may miss specific attack vectors.
16 / 45
Alex: "Hey team, I've flagged a potential vulnerability in the new user registration endpoint. The SAST tool is reporting a possible SQL injection risk on the 'email' parameter. Should we immediately deploy this PR or investigate further?"This scenario highlights the importance of critical thinking during code reviews. Simply accepting a SAST report as definitive is often premature—false positives are common. The correct response involves investigating the specific details of the reported vulnerability to determine its validity before making any deployment decisions. Prioritizing based solely on the tool's output without considering other factors (like severity, context, and potential false positives) can lead to wasted effort.
17 / 45
Sarah: 'I've just submitted this PR for the payment processing module. The SAST tool highlighted several potential issues – including a missing input validation on the 'amount' field and a possible XSS vulnerability in the display of transaction details. I've marked all these as 'false positives' to avoid blocking my work. What is the *most* appropriate next step for David, the security engineer, to take?While it's good practice to manage false positives, blindly marking issues as such without understanding *why* the SAST tool flagged them is dangerous. David should first understand Sarah's rationale – was there a legitimate reason for the lack of validation or potential XSS? He needs to verify that the findings are truly false and not masking a genuine vulnerability before allowing the PR to proceed, ensuring proper security practices are followed.
18 / 45
The team is reviewing a PR for a new API endpoint. The DAST tool has identified several potential vulnerabilities, including a lack of rate limiting and insufficient output encoding. David, the security engineer, needs to prioritize these findings. Which action demonstrates the *most* effective approach to addressing these DAST results?
This scenario highlights the practical application of DAST in a code review context. Prioritizing remediation based on severity scores allows David to focus on the most critical vulnerabilities first, minimizing immediate risk. This approach combines proactive security with efficient development workflow – a key element of modern software security practices. Ignoring or dismissing DAST findings without investigation is a dangerous oversimplification.
19 / 45
During a code review for the user profile service, Liam notes that the SAST tool flagged a potential use of deprecated cryptography libraries. The report suggests upgrading to the latest versions to mitigate risks associated with known vulnerabilities. However, upgrading requires significant refactoring and testing. Which statement best reflects Liam's approach to this finding?
Liam: 'Okay, I'll just mark this as a false positive and move on. It's not directly impacting any critical functionality.'
Liam: 'Okay, I'll just mark this as a false positive and move on. It's not directly impacting any critical functionality.'
This scenario highlights the importance of understanding the severity of SAST findings. A 'true' false positive might be acceptable for low-risk issues, but a deprecated cryptography library directly impacts security and represents an *urgent* vulnerability that needs to be addressed. Marking it as simply 'false' without further investigation is a missed opportunity to strengthen the application's defenses.
20 / 45
The team is discussing a DAST report highlighting potential vulnerabilities in the authentication service. The report indicates a lack of proper escaping of user input before it's used to construct database queries. One developer suggests simply adding a blanket `htmlspecialchars()` filter to all input fields. Another argues for more targeted sanitization based on the specific query parameters. Which approach is most aligned with a secure development practice, considering the potential for complex vulnerabilities?
This question tests understanding of nuanced vulnerability mitigation. While `htmlspecialchars()` can address some XSS issues, it's often not sufficient for preventing SQL injection attacks. Targeted sanitization – specifically, using parameterized queries or prepared statements – ensures that user input is treated as data and not as executable code, which is the core principle behind preventing database vulnerabilities. A blanket filter may miss specific attack vectors.
21 / 45
Alex: "Hey team, I've flagged a potential vulnerability in the new user registration endpoint. The SAST tool is reporting a possible SQL injection risk on the 'email' parameter. Should we immediately deploy this PR or investigate further?"This scenario highlights the importance of critical thinking during code reviews. Simply accepting a SAST report as definitive is often premature—false positives are common. The correct response involves investigating the specific details of the reported vulnerability to determine its validity before making any deployment decisions. Prioritizing based solely on the tool's output without considering other factors (like severity, context, and potential false positives) can lead to wasted effort.
22 / 45
Sarah: 'I've just submitted this PR for the payment processing module. The SAST tool highlighted several potential issues – including a missing input validation on the 'amount' field and a possible XSS vulnerability in the display of transaction details. I've marked all these as 'false positives' to avoid blocking my work. What is the *most* appropriate next step for David, the security engineer, to take?While it's good practice to manage false positives, blindly marking issues as such without understanding *why* the SAST tool flagged them is dangerous. David should first understand Sarah's rationale – was there a legitimate reason for the lack of validation or potential XSS? He needs to verify that the findings are truly false and not masking a genuine vulnerability before allowing the PR to proceed, ensuring proper security practices are followed.
23 / 45
The team is reviewing a PR for a new API endpoint. The DAST tool has identified several potential vulnerabilities, including a lack of rate limiting and insufficient output encoding. David, the security engineer, needs to prioritize these findings. Which action demonstrates the *most* effective approach to addressing these DAST results?
This scenario highlights the practical application of DAST in a code review context. Prioritizing remediation based on severity scores allows David to focus on the most critical vulnerabilities first, minimizing immediate risk. This approach combines proactive security with efficient development workflow – a key element of modern software security practices. Ignoring or dismissing DAST findings without investigation is a dangerous oversimplification.
24 / 45
During a code review for the user profile service, Liam notes that the SAST tool flagged a potential use of deprecated cryptography libraries. The report suggests upgrading to the latest versions to mitigate risks associated with known vulnerabilities. However, upgrading requires significant refactoring and testing. Which statement best reflects Liam's approach to this finding?
Liam: 'Okay, I'll just mark this as a false positive and move on. It's not directly impacting any critical functionality.'
Liam: 'Okay, I'll just mark this as a false positive and move on. It's not directly impacting any critical functionality.'
This scenario highlights the importance of understanding the severity of SAST findings. A 'true' false positive might be acceptable for low-risk issues, but a deprecated cryptography library directly impacts security and represents an *urgent* vulnerability that needs to be addressed. Marking it as simply 'false' without further investigation is a missed opportunity to strengthen the application's defenses.
25 / 45
The team is discussing a DAST report highlighting potential vulnerabilities in the authentication service. The report indicates a lack of proper escaping of user input before it's used to construct database queries. One developer suggests simply adding a blanket `htmlspecialchars()` filter to all input fields. Another argues for more targeted sanitization based on the specific query parameters. Which approach is most aligned with a secure development practice, considering the potential for complex vulnerabilities?
This question tests understanding of nuanced vulnerability mitigation. While `htmlspecialchars()` can address some XSS issues, it's often not sufficient for preventing SQL injection attacks. Targeted sanitization – specifically, using parameterized queries or prepared statements – ensures that user input is treated as data and not as executable code, which is the core principle behind preventing database vulnerabilities. A blanket filter may miss specific attack vectors.
26 / 45
Alex: "Hey team, I've flagged a potential vulnerability in the new user registration endpoint. The SAST tool is reporting a possible SQL injection risk on the 'email' parameter. Should we immediately deploy this PR or investigate further?"This scenario highlights the importance of critical thinking during code reviews. Simply accepting a SAST report as definitive is often premature—false positives are common. The correct response involves investigating the specific details of the reported vulnerability to determine its validity before making any deployment decisions. Prioritizing based solely on the tool's output without considering other factors (like severity, context, and potential false positives) can lead to wasted effort.
27 / 45
Sarah: 'I've just submitted this PR for the payment processing module. The SAST tool highlighted several potential issues – including a missing input validation on the 'amount' field and a possible XSS vulnerability in the display of transaction details. I've marked all these as 'false positives' to avoid blocking my work. What is the *most* appropriate next step for David, the security engineer, to take?While it's good practice to manage false positives, blindly marking issues as such without understanding *why* the SAST tool flagged them is dangerous. David should first understand Sarah's rationale – was there a legitimate reason for the lack of validation or potential XSS? He needs to verify that the findings are truly false and not masking a genuine vulnerability before allowing the PR to proceed, ensuring proper security practices are followed.
28 / 45
The team is reviewing a PR for a new API endpoint. The DAST tool has identified several potential vulnerabilities, including a lack of rate limiting and insufficient output encoding. David, the security engineer, needs to prioritize these findings. Which action demonstrates the *most* effective approach to addressing these DAST results?
This scenario highlights the practical application of DAST in a code review context. Prioritizing remediation based on severity scores allows David to focus on the most critical vulnerabilities first, minimizing immediate risk. This approach combines proactive security with efficient development workflow – a key element of modern software security practices. Ignoring or dismissing DAST findings without investigation is a dangerous oversimplification.
29 / 45
During a code review for the user profile service, Liam notes that the SAST tool flagged a potential use of deprecated cryptography libraries. The report suggests upgrading to the latest versions to mitigate risks associated with known vulnerabilities. However, upgrading requires significant refactoring and testing. Which statement best reflects Liam's approach to this finding?
Liam: 'Okay, I'll just mark this as a false positive and move on. It's not directly impacting any critical functionality.'
Liam: 'Okay, I'll just mark this as a false positive and move on. It's not directly impacting any critical functionality.'
This scenario highlights the importance of understanding the severity of SAST findings. A 'true' false positive might be acceptable for low-risk issues, but a deprecated cryptography library directly impacts security and represents an *urgent* vulnerability that needs to be addressed. Marking it as simply 'false' without further investigation is a missed opportunity to strengthen the application's defenses.
30 / 45
The team is discussing a DAST report highlighting potential vulnerabilities in the authentication service. The report indicates a lack of proper escaping of user input before it's used to construct database queries. One developer suggests simply adding a blanket `htmlspecialchars()` filter to all input fields. Another argues for more targeted sanitization based on the specific query parameters. Which approach is most aligned with a secure development practice, considering the potential for complex vulnerabilities?
This question tests understanding of nuanced vulnerability mitigation. While `htmlspecialchars()` can address some XSS issues, it's often not sufficient for preventing SQL injection attacks. Targeted sanitization – specifically, using parameterized queries or prepared statements – ensures that user input is treated as data and not as executable code, which is the core principle behind preventing database vulnerabilities. A blanket filter may miss specific attack vectors.
31 / 45
Alex: "Hey team, I've flagged a potential vulnerability in the new user registration endpoint. The SAST tool is reporting a possible SQL injection risk on the 'email' parameter. Should we immediately deploy this PR or investigate further?"This scenario highlights the importance of critical thinking during code reviews. Simply accepting a SAST report as definitive is often premature—false positives are common. The correct response involves investigating the specific details of the reported vulnerability to determine its validity before making any deployment decisions. Prioritizing based solely on the tool's output without considering other factors (like severity, context, and potential false positives) can lead to wasted effort.
32 / 45
Sarah: 'I've just submitted this PR for the payment processing module. The SAST tool highlighted several potential issues – including a missing input validation on the 'amount' field and a possible XSS vulnerability in the display of transaction details. I've marked all these as 'false positives' to avoid blocking my work. What is the *most* appropriate next step for David, the security engineer, to take?While it's good practice to manage false positives, blindly marking issues as such without understanding *why* the SAST tool flagged them is dangerous. David should first understand Sarah's rationale – was there a legitimate reason for the lack of validation or potential XSS? He needs to verify that the findings are truly false and not masking a genuine vulnerability before allowing the PR to proceed, ensuring proper security practices are followed.
33 / 45
The team is reviewing a PR for a new API endpoint. The DAST tool has identified several potential vulnerabilities, including a lack of rate limiting and insufficient output encoding. David, the security engineer, needs to prioritize these findings. Which action demonstrates the *most* effective approach to addressing these DAST results?
This scenario highlights the practical application of DAST in a code review context. Prioritizing remediation based on severity scores allows David to focus on the most critical vulnerabilities first, minimizing immediate risk. This approach combines proactive security with efficient development workflow – a key element of modern software security practices. Ignoring or dismissing DAST findings without investigation is a dangerous oversimplification.
34 / 45
During a code review for the user profile service, Liam notes that the SAST tool flagged a potential use of deprecated cryptography libraries. The report suggests upgrading to the latest versions to mitigate risks associated with known vulnerabilities. However, upgrading requires significant refactoring and testing. Which statement best reflects Liam's approach to this finding?
Liam: 'Okay, I'll just mark this as a false positive and move on. It's not directly impacting any critical functionality.'
Liam: 'Okay, I'll just mark this as a false positive and move on. It's not directly impacting any critical functionality.'
This scenario highlights the importance of understanding the severity of SAST findings. A 'true' false positive might be acceptable for low-risk issues, but a deprecated cryptography library directly impacts security and represents an *urgent* vulnerability that needs to be addressed. Marking it as simply 'false' without further investigation is a missed opportunity to strengthen the application's defenses.
35 / 45
The team is discussing a DAST report highlighting potential vulnerabilities in the authentication service. The report indicates a lack of proper escaping of user input before it's used to construct database queries. One developer suggests simply adding a blanket `htmlspecialchars()` filter to all input fields. Another argues for more targeted sanitization based on the specific query parameters. Which approach is most aligned with a secure development practice, considering the potential for complex vulnerabilities?
This question tests understanding of nuanced vulnerability mitigation. While `htmlspecialchars()` can address some XSS issues, it's often not sufficient for preventing SQL injection attacks. Targeted sanitization – specifically, using parameterized queries or prepared statements – ensures that user input is treated as data and not as executable code, which is the core principle behind preventing database vulnerabilities. A blanket filter may miss specific attack vectors.
36 / 45
Alex: "Hey team, I've flagged a potential vulnerability in the new user registration endpoint. The SAST tool is reporting a possible SQL injection risk on the 'email' parameter. Should we immediately deploy this PR or investigate further?"This scenario highlights the importance of critical thinking during code reviews. Simply accepting a SAST report as definitive is often premature—false positives are common. The correct response involves investigating the specific details of the reported vulnerability to determine its validity before making any deployment decisions. Prioritizing based solely on the tool's output without considering other factors (like severity, context, and potential false positives) can lead to wasted effort.
37 / 45
Sarah: 'I've just submitted this PR for the payment processing module. The SAST tool highlighted several potential issues – including a missing input validation on the 'amount' field and a possible XSS vulnerability in the display of transaction details. I've marked all these as 'false positives' to avoid blocking my work. What is the *most* appropriate next step for David, the security engineer, to take?While it's good practice to manage false positives, blindly marking issues as such without understanding *why* the SAST tool flagged them is dangerous. David should first understand Sarah's rationale – was there a legitimate reason for the lack of validation or potential XSS? He needs to verify that the findings are truly false and not masking a genuine vulnerability before allowing the PR to proceed, ensuring proper security practices are followed.
38 / 45
The team is reviewing a PR for a new API endpoint. The DAST tool has identified several potential vulnerabilities, including a lack of rate limiting and insufficient output encoding. David, the security engineer, needs to prioritize these findings. Which action demonstrates the *most* effective approach to addressing these DAST results?
This scenario highlights the practical application of DAST in a code review context. Prioritizing remediation based on severity scores allows David to focus on the most critical vulnerabilities first, minimizing immediate risk. This approach combines proactive security with efficient development workflow – a key element of modern software security practices. Ignoring or dismissing DAST findings without investigation is a dangerous oversimplification.
39 / 45
During a code review for the user profile service, Liam notes that the SAST tool flagged a potential use of deprecated cryptography libraries. The report suggests upgrading to the latest versions to mitigate risks associated with known vulnerabilities. However, upgrading requires significant refactoring and testing. Which statement best reflects Liam's approach to this finding?
Liam: 'Okay, I'll just mark this as a false positive and move on. It's not directly impacting any critical functionality.'
Liam: 'Okay, I'll just mark this as a false positive and move on. It's not directly impacting any critical functionality.'
This scenario highlights the importance of understanding the severity of SAST findings. A 'true' false positive might be acceptable for low-risk issues, but a deprecated cryptography library directly impacts security and represents an *urgent* vulnerability that needs to be addressed. Marking it as simply 'false' without further investigation is a missed opportunity to strengthen the application's defenses.
40 / 45
The team is discussing a DAST report highlighting potential vulnerabilities in the authentication service. The report indicates a lack of proper escaping of user input before it's used to construct database queries. One developer suggests simply adding a blanket `htmlspecialchars()` filter to all input fields. Another argues for more targeted sanitization based on the specific query parameters. Which approach is most aligned with a secure development practice, considering the potential for complex vulnerabilities?
This question tests understanding of nuanced vulnerability mitigation. While `htmlspecialchars()` can address some XSS issues, it's often not sufficient for preventing SQL injection attacks. Targeted sanitization – specifically, using parameterized queries or prepared statements – ensures that user input is treated as data and not as executable code, which is the core principle behind preventing database vulnerabilities. A blanket filter may miss specific attack vectors.
41 / 45
Alex: "Hey team, I've flagged a potential vulnerability in the new user registration endpoint. The SAST tool is reporting a possible SQL injection risk on the 'email' parameter. Should we immediately deploy this PR or investigate further?"This scenario highlights the importance of critical thinking during code reviews. Simply accepting a SAST report as definitive is often premature—false positives are common. The correct response involves investigating the specific details of the reported vulnerability to determine its validity before making any deployment decisions. Prioritizing based solely on the tool's output without considering other factors (like severity, context, and potential false positives) can lead to wasted effort.
42 / 45
Sarah: 'I've just submitted this PR for the payment processing module. The SAST tool highlighted several potential issues – including a missing input validation on the 'amount' field and a possible XSS vulnerability in the display of transaction details. I've marked all these as 'false positives' to avoid blocking my work. What is the *most* appropriate next step for David, the security engineer, to take?While it's good practice to manage false positives, blindly marking issues as such without understanding *why* the SAST tool flagged them is dangerous. David should first understand Sarah's rationale – was there a legitimate reason for the lack of validation or potential XSS? He needs to verify that the findings are truly false and not masking a genuine vulnerability before allowing the PR to proceed, ensuring proper security practices are followed.
43 / 45
The team is reviewing a PR for a new API endpoint. The DAST tool has identified several potential vulnerabilities, including a lack of rate limiting and insufficient output encoding. David, the security engineer, needs to prioritize these findings. Which action demonstrates the *most* effective approach to addressing these DAST results?
This scenario highlights the practical application of DAST in a code review context. Prioritizing remediation based on severity scores allows David to focus on the most critical vulnerabilities first, minimizing immediate risk. This approach combines proactive security with efficient development workflow – a key element of modern software security practices. Ignoring or dismissing DAST findings without investigation is a dangerous oversimplification.
44 / 45
During a code review for the user profile service, Liam notes that the SAST tool flagged a potential use of deprecated cryptography libraries. The report suggests upgrading to the latest versions to mitigate risks associated with known vulnerabilities. However, upgrading requires significant refactoring and testing. Which statement best reflects Liam's approach to this finding?
Liam: 'Okay, I'll just mark this as a false positive and move on. It's not directly impacting any critical functionality.'
Liam: 'Okay, I'll just mark this as a false positive and move on. It's not directly impacting any critical functionality.'
This scenario highlights the importance of understanding the severity of SAST findings. A 'true' false positive might be acceptable for low-risk issues, but a deprecated cryptography library directly impacts security and represents an *urgent* vulnerability that needs to be addressed. Marking it as simply 'false' without further investigation is a missed opportunity to strengthen the application's defenses.
45 / 45
The team is discussing a DAST report highlighting potential vulnerabilities in the authentication service. The report indicates a lack of proper escaping of user input before it's used to construct database queries. One developer suggests simply adding a blanket `htmlspecialchars()` filter to all input fields. Another argues for more targeted sanitization based on the specific query parameters. Which approach is most aligned with a secure development practice, considering the potential for complex vulnerabilities?
This question tests understanding of nuanced vulnerability mitigation. While `htmlspecialchars()` can address some XSS issues, it's often not sufficient for preventing SQL injection attacks. Targeted sanitization – specifically, using parameterized queries or prepared statements – ensures that user input is treated as data and not as executable code, which is the core principle behind preventing database vulnerabilities. A blanket filter may miss specific attack vectors.
Frequently Asked Questions
What does the "SAST & DAST Vocabulary" exercise cover?
Practice vocabulary for SAST, DAST, IAST, SCA, and security finding terminology used in DevSecOps pipelines.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
How many questions are in "SAST & DAST Vocabulary"?
This exercise has 45 questions. Each one gives instant feedback with an explanation, so you can see exactly why an answer is right or wrong.
Do I need to create an account to save my progress?
No account is required. The progress bar and score are tracked in your browser for the current session -- the exercise is designed to be a quick, repeatable drill rather than something you resume later.
What happens if I get an answer wrong?
You'll see the correct answer highlighted immediately, along with a short explanation of why it's correct. Wrong answers aren't penalized beyond your score, and you can keep going through every question.
How is this exercise different from reading an article?
Articles explain vocabulary and concepts through prose, while exercises like this one are interactive drills -- multiple-choice questions -- that test and reinforce your recall of specific terms and phrasing.
Can I retry this exercise?
Yes -- use the "Try again" button on the results screen to reset your score and go through all the questions again from the start.
Where can I find more Devsecops Pipeline Language exercises?
Browse the full Devsecops Pipeline Language hub for related drills, or check the site-wide exercises index for other IT English topics.
Is this exercise suitable for beginners?
This exercise assumes basic familiarity with IT terminology. If a term feels unfamiliar, check the site Glossary for a plain-English definition before attempting the questions.
How often is new content like this published?
New exercises are added regularly across all categories, alongside new vocabulary sets and articles. Check back on the exercises hub to see what's new.