SOFTWARE SECURITY AND TESTING
MASTER FINAL EXAM PREP
QUESTIONS AND ANSWERS
1. Which of the following describes the primary difference between Static Application
Security Testing (SAST) and Dynamic Application Security Testing (DAST)?
A. SAST requires a running application, while DAST analyzes source code.
B. SAST is used for black-box testing, while DAST is used for white-box testing.
C. SAST analyzes source code without execution, while DAST tests the application in its
running state.
D. SAST focuses on network vulnerabilities, while DAST focuses on logic flaws.
Answer: C
Conceptual Explanation: SAST is a white-box testing method that examines code, binaries,
or byte code without executing the program. DAST is a black-box testing method that
identifies vulnerabilities by interacting with a running application.
,2. When implementing defense against SQL Injection, why is ‘Input Validation’ considered
insufficient compared to ‘Parameterized Queries’?
A. Parameterized queries encrypt the data, making it impossible for attackers to read.
B. Input validation is resource-intensive and slows down the database performance.
C. Input validation only checks for length and type, whereas parameterized queries
separate code from data.
D. Input validation requires manual updates for every new SQL syntax variation, whereas
parameterized queries are automatic.
Answer: C
Conceptual Explanation: While validation helps, attackers can often bypass it using clever
encoding. Parameterized queries (prepared statements) ensure the database treats user
input strictly as data, never as executable code.
3. In the context of the OWASP Top 10, which vulnerability occurs when an application
includes untrusted data in a web page without proper validation or escaping?
A. Insecure Deserialization
B. Broken Access Control
C. Cross-Site Scripting (XSS)
D. Security Misconfiguration
Answer: C
, Conceptual Explanation: XSS occurs when an application includes untrusted data in a web
page without proper validation or escaping, allowing scripts to execute in the victim’s
browser.
4. Which CVSS (Common Vulnerability Scoring System) metric group represents the intrinsic
qualities of a vulnerability that are constant over time and across user environments?
A. Environmental Metric Group
B. Temporal Metric Group
C. Base Metric Group
D. Impact Metric Group
Answer: C
Conceptual Explanation: The Base Metric Group captures the qualities of a vulnerability
that are inherent to the flaw itself and do not change over time or depending on the
environment.
5. What is the primary purpose of a ‘Salt’ in password hashing?
A. To encrypt the password before it is hashed.
B. To make the hashing algorithm run slower to prevent brute-force attacks.
C. To compress the password into a smaller size for faster database lookups.
D. To ensure that identical passwords result in different hashes, preventing rainbow table
attacks.
MASTER FINAL EXAM PREP
QUESTIONS AND ANSWERS
1. Which of the following describes the primary difference between Static Application
Security Testing (SAST) and Dynamic Application Security Testing (DAST)?
A. SAST requires a running application, while DAST analyzes source code.
B. SAST is used for black-box testing, while DAST is used for white-box testing.
C. SAST analyzes source code without execution, while DAST tests the application in its
running state.
D. SAST focuses on network vulnerabilities, while DAST focuses on logic flaws.
Answer: C
Conceptual Explanation: SAST is a white-box testing method that examines code, binaries,
or byte code without executing the program. DAST is a black-box testing method that
identifies vulnerabilities by interacting with a running application.
,2. When implementing defense against SQL Injection, why is ‘Input Validation’ considered
insufficient compared to ‘Parameterized Queries’?
A. Parameterized queries encrypt the data, making it impossible for attackers to read.
B. Input validation is resource-intensive and slows down the database performance.
C. Input validation only checks for length and type, whereas parameterized queries
separate code from data.
D. Input validation requires manual updates for every new SQL syntax variation, whereas
parameterized queries are automatic.
Answer: C
Conceptual Explanation: While validation helps, attackers can often bypass it using clever
encoding. Parameterized queries (prepared statements) ensure the database treats user
input strictly as data, never as executable code.
3. In the context of the OWASP Top 10, which vulnerability occurs when an application
includes untrusted data in a web page without proper validation or escaping?
A. Insecure Deserialization
B. Broken Access Control
C. Cross-Site Scripting (XSS)
D. Security Misconfiguration
Answer: C
, Conceptual Explanation: XSS occurs when an application includes untrusted data in a web
page without proper validation or escaping, allowing scripts to execute in the victim’s
browser.
4. Which CVSS (Common Vulnerability Scoring System) metric group represents the intrinsic
qualities of a vulnerability that are constant over time and across user environments?
A. Environmental Metric Group
B. Temporal Metric Group
C. Base Metric Group
D. Impact Metric Group
Answer: C
Conceptual Explanation: The Base Metric Group captures the qualities of a vulnerability
that are inherent to the flaw itself and do not change over time or depending on the
environment.
5. What is the primary purpose of a ‘Salt’ in password hashing?
A. To encrypt the password before it is hashed.
B. To make the hashing algorithm run slower to prevent brute-force attacks.
C. To compress the password into a smaller size for faster database lookups.
D. To ensure that identical passwords result in different hashes, preventing rainbow table
attacks.
