712-50 Question 321
Select 3Understand software vulnerability analysis techniques including static code, dynamic code, and software composition analysisA global financial services company is accelerating releases of a customer-facing web platform built with internally developed code and multiple open-source libraries. After a recent incident, executives ask the CISO to recommend a vulnerability analysis approach that improves visibility into coding flaws before production, identifies runtime issues that only appear when the application is executing, and reduces risk from vulnerable third-party components already embedded in the software. Budget is limited, so the CISO wants to prioritize techniques that directly address these three needs across the SDLC. Which THREE actions should the CISO recommend?
- A
Integrate static application security testing (SAST) into the CI pipeline to detect insecure coding patterns and common flaws in source code before deployment
- B
Deploy dynamic application security testing (DAST) against running test environments to identify execution-time issues such as authentication, input handling, and configuration weaknesses
- C
Implement software composition analysis (SCA) to inventory third-party and open-source dependencies and identify components with known vulnerabilities or licensing concerns
- D
Rely primarily on perimeter vulnerability scanning of the production servers because it will identify both source-code flaws and vulnerable open-source libraries embedded in the application
- E
Replace code review and vulnerability testing with annual penetration testing, since a yearly external assessment provides equivalent coverage to SAST, DAST, and SCA combined
Show answer and explanation
Correct answers: A, B, C
Explanation
The best recommendation is a combination of SAST, DAST, and SCA because each addresses a distinct aspect of software vulnerability analysis. SAST supports early identification of weaknesses in internally developed code; DAST finds issues that emerge only when the application is executing; and SCA addresses risks introduced by open-source and third-party dependencies. For a CISO, this is the most practical and risk-based recommendation because it aligns security activities to different failure points across the SDLC rather than over-relying on a single control.
This approach is consistent with widely recognized best practices from OWASP and NIST. OWASP distinguishes between SAST, DAST, and software component/dependency analysis as complementary application security testing methods. NIST Secure Software Development Framework (SSDF), SP 800-218, emphasizes integrating security checks throughout development, including identifying vulnerabilities in source code and managing third-party components. Using these techniques together improves governance, reduces release risk, and provides leadership with measurable coverage across custom code, runtime behavior, and software supply chain exposure.
- A. Correct.
Correct. SAST analyzes source code, bytecode, or binaries without executing the application. It is well suited for early detection of coding flaws such as injection risks, insecure API use, poor input validation patterns, and other weaknesses before deployment. Integrating SAST into CI/CD supports shift-left security and is particularly effective for internally developed code, which is one of the stated executive concerns.
- B. Correct.
Correct. DAST evaluates the application while it is running and interacting with requests and responses. This makes it useful for finding issues that may not be visible through static review alone, including runtime configuration problems, authentication and session management weaknesses, and certain input-handling issues exposed only during execution. It directly addresses the requirement to identify runtime issues in executing applications.
- C. Correct.
Correct. SCA is designed to identify and inventory third-party and open-source components, map dependencies, and check them against known vulnerability databases and policy requirements. This directly addresses the organization's need to reduce risk from vulnerable embedded libraries. Many SCA platforms also help detect outdated components and license risks, both important in enterprise software governance.
- D. Incorrect.
Incorrect. Infrastructure or perimeter vulnerability scanning can identify exposed services, missing patches on hosts, and some web-facing weaknesses, but it does not provide comprehensive analysis of source-code flaws or a reliable inventory of embedded third-party application libraries. Choosing this option reflects the common misconception that network or host scanning can replace application-focused analysis techniques.
- E. Incorrect.
Incorrect. Annual penetration testing is valuable, especially for validating exploitability and control effectiveness, but it is periodic and limited in scope compared with continuous SAST, DAST, and SCA. It cannot replace systematic code analysis, runtime testing during development, or dependency monitoring. This option reflects the misconception that one assessment activity can provide equivalent SDLC coverage.