Which of the following would MOST likely be included in the final report of a static application- security test that was written with a team of application developers as the intended audience?

Question

Options

• AExecutive summary of the penetration-testing methods used
• BBill of materials including supplies, subcontracts, and costs incurred during assessment
• CQuantitative impact assessments given a successful software compromise
• DCode context for instances of unsafe type-casting operations

• A
  4% (1)
• B
  11% (3)
• C
  4% (1)
• D
  81% (22)

Explanation

When the intended audience is application developers, the report must provide actionable, technical detail they can use to remediate vulnerabilities. Showing the specific lines of code where unsafe type-casting occurs gives developers the precise context they need to fix the issue. An executive summary (A) is intended for non-technical leadership. A bill of materials (B) is a financial/administrative artifact. Quantitative impact assessments (C) are meaningful to management and risk stakeholders, not necessarily to developers writing code fixes.

No community discussion yet for this question.