Secure Software Testing

Which THREE factors should be considered when prioritizing findings from a DAST scan?

When designing a test case for secure API authentication, which THREE elements should be included?

Which TWO of the following represent common output formats for security testing reports?

A developer wants to ensure that a web application is resistant to SQL injection. Which test case should be included in the automated test suite?

Which TWO of the following practices are recommended when performing fuzz testing on a web service?

You are performing a fuzzing campaign on a REST API. The API uses JSON Web Tokens (JWT). What is the most effective way to include these tokens in the fuzzer input?

Which TWO of the following are primary benefits of integrating SAST into the early stages of the SDLC?

A security analyst is reviewing the results of a dynamic application security testing (DAST) scan against a REST API. The scan report includes several findings, but the analyst must prioritize remediation. Which two factors are most important to consider when triaging DAST findings for an API? (Choose two.)

When designing a test case for a secure authentication bypass, which THREE areas should be covered?

A security engineer is configuring SonarQube for a Java project. Which configuration step ensures that the SAST scan accurately identifies injection vulnerabilities by analyzing data flow paths?

When configuring a DAST scanner to test for Cross-Site Request Forgery (CSRF), what must the scanner be able to do?

A developer is using AFL (American Fuzzy Lop) for fuzzing a C++ application. What is the primary requirement for achieving high coverage?

During a manual penetration test, you discover an insecure direct object reference (IDOR). What is the most appropriate next step in the test case design for this finding?

Which TWO of the following are common challenges when implementing IAST?

A software development team is adopting a secure software testing strategy. They want to ensure that security testing is performed continuously and that feedback is provided to developers as early as possible. Which testing approach best aligns with this goal?

A security tester is performing interactive application security testing (IAST) on a Java web application. The IAST agent is deployed in the test environment and instruments the application during automated functional tests. The tester notices that the IAST tool reports a high number of false positives for SQL injection. What is the most likely cause of these false positives?

When performing automated security testing, which of the following is considered a 'false positive'?