CAS-003 · Question #893
A system integrator wants to assess the security of the application binaries delivered by its subcontracted vendors. The vendors do not deliver source code as a part of their contract. Which of the…
The correct answer is B. Logic flow analysis F. Static code analysis tool. When source code is unavailable, binary-level techniques such as logic flow analysis and static analysis tools that support compiled artifacts allow security assessment of delivered binaries.
Question
A system integrator wants to assess the security of the application binaries delivered by its subcontracted vendors. The vendors do not deliver source code as a part of their contract. Which of the Mowing techniques can the integrator use to accomplish the objective? (Select TWO)
Options
- ARegression test
- BLogic flow analysis
- CCode signature validation
- DFuzziest
- EDisassemble/decompile
- FStatic code analysis tool
How the community answered
(31 responses)- A10% (3)
- B65% (20)
- C19% (6)
- D3% (1)
- E3% (1)
Why each option
When source code is unavailable, binary-level techniques such as logic flow analysis and static analysis tools that support compiled artifacts allow security assessment of delivered binaries.
Regression testing verifies that previously working functionality still operates correctly after a change - it does not identify security vulnerabilities in binary artifacts.
Logic flow analysis examines execution paths and control flow within an application and can be applied to compiled binaries using tools that reconstruct program logic without requiring the original source code.
Code signature validation confirms the integrity and authenticity of a binary by verifying it has not been tampered with, but does not surface internal security flaws within the code.
Fuzzing is a dynamic testing technique that supplies malformed input to a running application - it requires execution context and is not a binary inspection method.
Disassembly and decompilation are reverse engineering preparatory steps that convert binary into readable form - they are enablers of analysis, not security assessment techniques themselves.
Static code analysis tools can operate on compiled binaries, bytecode, or intermediate language representations to detect security vulnerabilities without needing access to source code.
Concept tested: Binary security assessment without source code access
Source: https://owasp.org/www-project-source-code-analysis-tools/
Topics
Community Discussion
No community discussion yet for this question.