CAS-004 practice question 12 of 35

A company's software developers have indicated that the security team takes too long to perform application security tasks. A security analyst plans…

A company's software developers have indicated that the security team takes too long to perform application security tasks. A security analyst plans to improve the situation by implementing security into the SDLC. The developers have the following requirements: 1. The solution must be able to initiate SQL injection and reflected XSS attacks. 2. The solution must ensure the application is not susceptible to memory leaks. Which of the following should be implemented to meet these requirements? (Select two).

Answer options

A: Side-channel analysis

B: Protocol scanner

C: HTTP interceptor

D: DAST Correct answer

E: Fuzz testing

F: SAST Correct answer

G: SCAP

Correct Answer:

D. DAST; F. SAST

Explanation

The combination of DAST (Dynamic Application Security Testing) and SAST (Static Application Security Testing) would meet the developers' requirements. DAST is used for runtime testing, capable of simulating attacks like SQL injection and reflected XSS, which fulfills the first requirement. SAST analyzes the code statically to ensure that the application is not vulnerable to issues like memory leaks, fulfilling the second requirement. Implementing both will integrate security testing into the SDLC, addressing the security concerns earlier in the development cycle, as recommended in CASP+. Reference: CASP+ CAS-004 Exam Objectives: Domain 2.0 – Enterprise Security Operations (DAST, SAST for Secure Software Development) CompTIA CASP+ Study Guide: Secure SDLC and Application Security Testing

Keep practicing

Take the free CAS-004 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test