nerdexam
CompTIA

CAS-003 · Question #893

A system integrator wants to assess the security of the application binaries delivered by its subcontracted vendors. The vendors do not deliver source code as a part of their contract. Which of the…

The correct answer is B. Logic flow analysis F. Static code analysis tool. When source code is unavailable, binary-level techniques such as logic flow analysis and static analysis tools that support compiled artifacts allow security assessment of delivered binaries.

Technical Integration of Enterprise Security

Question

A system integrator wants to assess the security of the application binaries delivered by its subcontracted vendors. The vendors do not deliver source code as a part of their contract. Which of the Mowing techniques can the integrator use to accomplish the objective? (Select TWO)

Options

  • ARegression test
  • BLogic flow analysis
  • CCode signature validation
  • DFuzziest
  • EDisassemble/decompile
  • FStatic code analysis tool

How the community answered

(31 responses)
  • A
    10% (3)
  • B
    65% (20)
  • C
    19% (6)
  • D
    3% (1)
  • E
    3% (1)

Why each option

When source code is unavailable, binary-level techniques such as logic flow analysis and static analysis tools that support compiled artifacts allow security assessment of delivered binaries.

ARegression test

Regression testing verifies that previously working functionality still operates correctly after a change - it does not identify security vulnerabilities in binary artifacts.

BLogic flow analysisCorrect

Logic flow analysis examines execution paths and control flow within an application and can be applied to compiled binaries using tools that reconstruct program logic without requiring the original source code.

CCode signature validation

Code signature validation confirms the integrity and authenticity of a binary by verifying it has not been tampered with, but does not surface internal security flaws within the code.

DFuzziest

Fuzzing is a dynamic testing technique that supplies malformed input to a running application - it requires execution context and is not a binary inspection method.

EDisassemble/decompile

Disassembly and decompilation are reverse engineering preparatory steps that convert binary into readable form - they are enablers of analysis, not security assessment techniques themselves.

FStatic code analysis toolCorrect

Static code analysis tools can operate on compiled binaries, bytecode, or intermediate language representations to detect security vulnerabilities without needing access to source code.

Concept tested: Binary security assessment without source code access

Source: https://owasp.org/www-project-source-code-analysis-tools/

Topics

#binary analysis#reverse engineering#static analysis#code review without source

Community Discussion

No community discussion yet for this question.

Full CAS-003 Practice