A penetration tester reviews a SAST vulnerability scan report. The following lines of code have been reported as vulnerable: Which of the following is the best method to remediate this vulnerability?

Question

Options

• AImplementing a logging framework
• BRemoving the five code lines reported with issues
• CInitiating a secure coding-awareness program with all the developers
• DDocumenting the vulnerability as a false positive

• A
  79% (31)
• B
  13% (5)
• C
  5% (2)
• D
  3% (1)

Explanation

Explanation

Implementing a logging framework is the best remediation because SAST tools commonly flag insecure or inconsistent logging practices - such as hardcoded credentials in log statements, sensitive data exposure through logs, or improper error handling - and a proper logging framework enforces standardized, secure output that eliminates these weaknesses at the root cause.

Why the distractors are wrong:

• B (Removing the five lines) is incorrect because simply deleting the flagged code doesn't address the underlying vulnerability; the functionality likely still needs to exist, just implemented securely.
• C (Secure coding-awareness program) is a long-term cultural fix but does nothing to immediately remediate the specific identified vulnerability in production code.
• D (Documenting as a false positive) is incorrect because dismissing a legitimate vulnerability without investigation is irresponsible and leaves the system exposed.

Memory Tip: Think "Fix the root, not just the fruit" - when SAST flags logging issues, a logging framework fixes the systemic problem, whereas removing code only removes the symptom. If the scan flags logging-related lines, the answer will almost always involve improving how logging is done, not eliminating it entirely.

No community discussion yet for this question.