312-97 Practice Questions

Active IAST combines runtime agent monitoring with active security testing through a web scanner. The solution Sandra uses has both components: an active scanner that probes the application externally while an internal agent monitors the application's behavior and pinpoints vulnerabilities in the code. This dual approach of active scanning with runtime instrumentation is characteristic of Active IAST, which provides comprehensive security analysis by correlating external attack patterns with internal code execution paths.

B. Semi-passive IAST: This category doesn't exist in standard IAST taxonomy.

C. Semi-active IAST: Not a recognized IAST classification in industry standards.

D. Passive IAST: Only monitors runtime without active scanning component described.

3. References:

1. Gartner (2019). "Magic Quadrant for Application Security Testing" - Section on IAST Technologies, pp. 8-10

2. NIST SP 800-95 (2007). "Guide to Secure Web Services" - Chapter 4.2 on Runtime Security Testing

3. OWASP Testing Guide v4.0 (2014). "Interactive Application Security Testing" - Section 4.12.1

4. IEEE Computer Society (2017). "Runtime Application Self-Protection and Interactive Testing" - DOI: 10.1109/MSP.2017.3681052

5. Software Engineering Institute, Carnegie Mellon (2018). "DevSecOps: Integrating Security Testing" - Technical Note CMU/SEI-2018-TN-002, pp. 23-25

1. Gartner “Magic Quadrant for Application Security Testing”, 2014, §“Interactive AST”, p.11.

2. OWASP, “IAST – Passive vs Active Modes”, OWASP Wiki (2020-12-03), ¶3-4.

3. IEEE Security & Privacy, Vol. 15(4), 2017, “Interactive Application Security Testing”, pp. 80-83, DOI:10.1109/MSP.2017.3151346.

Rapid7 tCell integrates with AWS CloudFront by using Lambda@Edge. This AWS service allows code (a Lambda function) to run at AWS edge locations, closer to the end-user. This function intercepts viewer requests and responses as they pass through the CloudFront distribution. The tCell agent, packaged as a Lambda@Edge function and deployed via a CloudFormation stack, can inspect traffic, apply security policies, and protect the application at the edge, before malicious traffic reaches the origin server. This is the standard and officially supported method for this type of integration.

A. A standard Lambda function runs in a specific region and is not suitable for inspecting traffic at all global CloudFront edge locations.

B. Plugging into CloudFormation is nonsensical. CloudFormation is an Infrastructure as Code (IaC) service used for deployment, not a runtime environment to plug into.

D. This option incorrectly states plugging into CloudFormation. While Lambda@Edge is the correct technology, it integrates with CloudFront, not CloudFormation.

- Rapid7. (2023). AWS CloudFront with Lambda@Edge. tCell Documentation. Retrieved from https://docs.tcell.io/docs/aws-cloudfront-with-lambdaedge. (This official vendor documentation explicitly states, "The tCell agent can be plugged into CloudFront through Lambda@Edge.")

- Amazon Web Services. (2023). What Is Lambda@Edge?. Amazon CloudFront Developer Guide. Retrieved from https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-at-the-edge.html. (This official AWS documentation describes how Lambda@Edge works to customize content delivered through CloudFront, which is the mechanism used by tools like tCell.)

SonarLint is an IDE extension that provides on-the-fly feedback to developers as they write code. It detects and highlights bugs, code smells, and security vulnerabilities directly in the editor. This matches the requirement of fixing issues before the code is committed by providing immediate feedback and clear remediation guidance. It helps developers "shift left," addressing security concerns early in the development lifecycle.

B. Arachni is a Dynamic Application Security Testing (DAST) scanner, which analyzes running web applications, not static code before commit.

C. OWASP ZAP is primarily a DAST tool used for penetration testing of running web applications, not for static code analysis in an IDE.

D. Tenable.io is a comprehensive vulnerability management platform for scanning infrastructure and applications, not an IDE-based tool for pre-commit code analysis.

1. SonarSource. (n.d.). What is SonarLint? SonarLint Official Documentation. Retrieved from https://www.sonarlint.org/

"SonarLint is a FREE and Open Source IDE extension that identifies and helps you fix quality and security issues as you write code."

2. Cornell University, Department of Computer Science. (n.d.). CS 5152: Software Engineering - Tools. Retrieved from https://www.cs.cornell.edu/courses/cs5152/2020sp/tools.html. This courseware lists SonarLint as a static analysis tool for improving code quality.

Dynamic Application Security Testing (DAST) and fuzz testing are techniques that require a running application to analyze. They interact with the application from the outside, simulating attacks and providing unexpected inputs to identify vulnerabilities at runtime. This type of analysis is performed during the "Test-time" phase of the DevSecOps pipeline. In this phase, the application has been successfully built and deployed to a dedicated testing or staging environment, making it accessible for these dynamic, black-box testing tools to execute their checks before the application is promoted to production.

A: Commit-time checks are fast, static analyses (e.g., linting) performed on the source code itself, not a running application.

B: Build-time checks occur during code compilation and packaging, typically involving dependency scanning or deeper static analysis.

C: Deploy-time checks focus on the security of the target infrastructure and configuration, not the application's runtime behavior.

OWASP. (n.d.). "OWASP DevSecOps Guideline." OWASP Foundation. Section: "Phase 4: Test". Retrieved from https://owasp.org/www-project-devsecops-guideline/latest/04-Pipeline-Phase-Implementation/04-Phase-Test. (This guideline explicitly places DAST within the Test phase of the CI/CD pipeline).

Suresh, M., & Chow, J. (2020). A DevSecOps Reference Architecture. Software Engineering Institute, Carnegie Mellon University. CMU/SEI-2020-TN-011. Page 11, Figure 4. (This reference architecture diagram shows DAST occurring in the "Test/QA" stage of the DevSecOps pipeline).

The correct command to configure Git settings is git config. The question's options contain a typo, using get instead of git. Assuming this typo, option B provides the correct keys for setting the user's name and email: user.name and user.email. The --global flag ensures this configuration applies to all repositories for the current user on the system. This is a one-time setup command typically run after installing Git.

A. The command get is incorrect, and the key user-name (with a hyphen) is not the valid configuration key for the username.

C. The command get git config is syntactically incorrect. The correct command is simply git config.

D. The command get is incorrect, and the keys username and useremail (with underscores) are not the valid configuration keys.

1. Chacon, S., & Straub, B. (2014). Pro Git (2nd ed.). Apress. Chapter 1.6, Getting Started - First-Time Git Setup. The documentation explicitly states the commands are git config --global user.name "John Doe" and git config --global user.email [email protected].

2. Git Documentation. (n.d.). git-config Documentation. git-scm.com. Retrieved from https://git-scm.com/docs/git-config. The official documentation lists user.name and user.email as the correct configuration variables.

"Change lead time" (or Lead Time for Changes) is a key DevOps metric that measures the time from a code commit to that code successfully running in production. This metric, popularized by the DevOps Research and Assessment (DORA) team and adopted by agencies like the GSA, directly assesses the efficiency of the entire delivery pipeline. It encompasses the time spent in development, automated testing, security checks, and deployment. A short change lead time indicates a highly efficient and automated pipeline, enabling rapid delivery of both new features and bug fixes.

A: Mean time to recovery (MTTR) measures how quickly service can be restored after a production failure, not development speed.

B: Change volume measures the number of deployments or changes, not the time it takes to deliver a single change.

C: Time to value is a broader business metric measuring the time from idea conception to customer realization of value.

U.S. General Services Administration (GSA). (n.d.). "DevOps Metrics." Tech at GSA. Retrieved from https://tech.gsa.gov/guides/devopsmetrics/. (This official GSA guide lists "Lead time for changes" as a key metric, defining it as the time from commit to production).

Forsgren, N., Humble, J., & Kim, G. (2018). Accelerate: The Science of Lean Software and DevOps. IT Revolution Press. Chapter 2, "Measuring Performance". (This foundational book defines Lead Time for Changes as a core metric of software delivery performance).

GitHub Code Scanning is a native feature designed to analyze code within a GitHub repository to find security vulnerabilities and coding errors. This feature is powered by CodeQL, GitHub's advanced semantic code analysis engine. To set up code scanning, a user configures a GitHub Actions workflow that runs the CodeQL analysis. This process involves creating a .github/workflows/codeql-analysis.yml file that defines the triggers and languages to be scanned, effectively integrating CodeQL into the CI/CD pipeline.

A. Gauntlt is a security testing framework used for behavior-driven development, but it is not the underlying engine for GitHub's native Code Scanning feature.

B. GitMiner is a tool designed to mine and analyze data from Git repositories for patterns, not for performing static application security testing (SAST) like CodeQL.

C. OWASP ZAP is a popular open-source dynamic application security testing (DAST) tool for finding vulnerabilities in running web applications, not a static analysis engine for source code.

- GitHub. (n.d.). About code scanning. GitHub Docs. Retrieved from https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning. (See the section "About CodeQL").

- GitHub. (n.d.). Configuring code scanning for a repository. GitHub Docs. Retrieved from https://docs.github.com/en/code-security/code-scanning/configuring-code-scanning/configuring-code-scanning-for-a-repository. (See the section "Setting up code scanning with CodeQL").

Out-of-Band Application Security Testing (OAST) is a technique used to detect vulnerabilities that are not discoverable through traditional request-and-response scanning methods. Burp Suite's implementation of OAST is the Burp Collaborator. It works by sending payloads that cause the target application to interact with a Burp-controlled server over an external channel (e.g., DNS, HTTP). These "invisible" or out-of-band interactions confirm vulnerabilities like blind SQL injection or blind SSRF with high confidence, which significantly minimizes false positives compared to inferential-based scanning techniques.

B. QAST is not a recognized standard acronym within the application security testing domain.

C. MAST stands for Mobile Application Security Testing, which is a broad category of testing focused on mobile apps, not a specific technology for finding invisible vulnerabilities.

D. NAST is not a recognized standard acronym within the application security testing domain.

1. PortSwigger. "What is OAST (out-of-band application security testing)?". Web Security Academy. PortSwigger. "OAST can be used to detect issues that are completely invisible in the application's responses, such as blind SQL injection." (Source: https://portswigger.net/web-security/oast).

2. PortSwigger. "Burp Collaborator". Burp Suite Documentation. PortSwigger. "Burp Collaborator is a network service that Burp Suite uses to help discover many kinds of vulnerabilities... by inducing a target application to interact with the Collaborator server." (Source: https://portswigger.net/burp/documentation/collaborator).

GitLab CI/CD pipelines are configured using a YAML file named .gitlab-ci.yml located in the project's root directory. To integrate an external tool like Checkmarx, its predefined template is included in the main .gitlab-ci.yml file using the include: keyword. This allows the pipeline to execute the jobs defined in the Checkmarx template. The other filenames are not the standard convention recognized by GitLab for CI/CD configuration.

A. gitlab-cd.yml is not the standard filename for GitLab CI/CD configuration. GitLab specifically looks for .gitlab-ci.yml.

B. gitlab-ci/cd.yml is an incorrect filename and path. The configuration file must be in the project's root directory.

C. gitlab.yml is not the correct filename for defining CI/CD pipelines in GitLab.

1. GitLab Documentation. (n.d.). The .gitlab-ci.yml file. GitLab Docs. Retrieved from https://docs.gitlab.com/ee/ci/yaml/. In the introduction, it states, "To use GitLab CI/CD, you start with a .gitlab-ci.yml file in the root of your project."

2. GitLab Documentation. (n.d.). Keyword reference for the .gitlab-ci.yml file - include. GitLab Docs. Retrieved from https://docs.gitlab.com/ee/ci/yaml/index.html#include. This section details how to use the include keyword to incorporate external YAML files, including remote ones via URL.

3. Checkmarx Documentation. (2023). GitLab Integration. Retrieved from https://checkmarx.com/resource/documents/en/34965-6413-gitlab-integration.html. The integration guide specifies adding the Checkmarx template to the .gitlab-ci.yml file.

The kubectl get pods command is used to list one or more pods. To view resources within a specific namespace, the --namespace or its shorthand -n flag must be used. Since the Jenkins application was deployed into a namespace named "jenkins," the command kubectl get pods -n jenkins correctly targets that namespace and lists the pods running within it. This is the standard and correct procedure for querying namespaced resources in Kubernetes.

A. The -k flag is used for kustomize, which manages Kubernetes configuration, not for specifying a namespace in a get command.

B. The -s or --server flag is used to specify the address and port of the Kubernetes API server, not to filter resources by namespace.

D. The -p or --prune flag is an option for the kubectl apply command to remove resources and is not a valid flag for kubectl get pods.

- Kubernetes Documentation, kubectl get command. "Display one or many resources... Use the --namespace flag to specify the namespace." (kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#get)

- Kubernetes Documentation, Namespaces. "kubectl supports a --namespace flag for most commands to specify the namespace for the request." (kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/)