CCSP · Question #143
Which of the following is not a feature of SAST?
The correct answer is B. Team-building efforts. Static Application Security Testing (SAST) is a white-box testing methodology that analyzes an application's source code for vulnerabilities without executing it, and does not involve team-building efforts.
Question
Which of the following is not a feature of SAST?
Options
- ASource code review
- BTeam-building efforts
- C"White-box" testing
- DHighly skilled, often expensive outside consultants
How the community answered
(27 responses)- A4% (1)
- B89% (24)
- C7% (2)
Why each option
Static Application Security Testing (SAST) is a white-box testing methodology that analyzes an application's source code for vulnerabilities without executing it, and does not involve team-building efforts.
Source code review is a primary feature of SAST, as SAST tools examine the application's source code, bytecode, or binary code without executing it.
Team-building efforts are general organizational activities aimed at improving team cohesion and performance, and are not a technical feature, characteristic, or component of Static Application Security Testing (SAST). SAST is a technical process of analyzing code.
SAST is considered "white-box" testing because it requires access to the internal structure and code of the application to perform its analysis.
While SAST can be performed by automated tools, interpreting complex results, configuring tools, and performing manual code reviews often requires highly skilled, and potentially expensive, security consultants.
Concept tested: Static Application Security Testing (SAST) characteristics
Source: https://learn.microsoft.com/en-us/azure/security/develop/security-dev-overview#static-application-security-testing-sast
Topics
Community Discussion
No community discussion yet for this question.