PenTest+ V2 Static Source Code Review Techniques Quiz

1. Which tool is widely used for analyzing Python code for security issues?

Bandit

Checkmarx

Fortify

Veracode

2. Which term describes the practice of validating input at the point of entry?

Input validation

Output encoding

Error handling

Logging mechanisms

3. In a code review, what does the principle of least privilege relate to?

Functions and modules should have minimal required permissions

Code should be written in the simplest way possible

All users need full system access

Security reviews should be limited

4. Insecure cryptographic algorithms in code (e.g., MD5, DES) are detected by static analysis through what?

Identifying deprecated or weak algorithm usage patterns

Monitoring runtime performance

Analyzing network encryption

Testing password strength

5. What does control flow analysis in static review help identify?

Unreachable code and logic flaws that may hide vulnerabilities

Network routing decisions

Database indexing strategies

API rate limiting configurations

6. Buffer overflow vulnerabilities in C/C++ are typically identified by detecting what?

Unsafe functions like strcpy() and sprintf() without bounds checking

Proper memory allocation

Use of stack canaries

Address space layout randomization (ASLR)

7. Which configuration management tool can integrate with SAST to scan infrastructure code?

Terraform

Wireshark

Hashcat

Tcpdump

8. What is a false positive in static code analysis?

A reported vulnerability that does not actually exist

A vulnerability that was not detected

A correctly identified security flaw

A test that passes unexpectedly

9. In static code analysis, what does data flow analysis examine?

How data moves through variables and functions

Network packet patterns

User authentication logs

Database transaction history

10. Path traversal vulnerabilities are detected in code by identifying what pattern?

User input used to construct file paths without validation

Proper use of canonicalization

Encrypted file storage

Read-only file permissions

11. Which of the following best describes static code analysis?

Analyzing code without executing it to find vulnerabilities

Testing code only during runtime execution

Manually reviewing code line-by-line without tools

Analyzing network traffic during application runtime

12. What is the primary purpose of code complexity analysis in static review?

To identify sections prone to logic errors and vulnerabilities

To measure execution speed

To count lines of code

To optimize memory usage

13. Which OWASP Top 10 category relates to insecure deserialization?

A08:2021 – Software and Data Integrity Failures

A01:2021 – Broken Access Control

A03:2021 – Injection

A02:2021 – Cryptographic Failures

14. Cross-site scripting (XSS) vulnerabilities in code are typically found by identifying what?

Unescaped user input rendered in HTML output

Proper input validation routines

Encrypted data transmission

Secure session management

15. In static code review, what does taint analysis help identify?

How untrusted data flows through an application

Memory allocation patterns

Network bandwidth usage

Database query performance

16. Which CWE (Common Weakness Enumeration) category covers hardcoded credentials in code?

CWE-798

CWE-79

CWE-89

CWE-434

17. What does SAST stand for in the context of code analysis?

Static Application Security Testing

Software Automated Security Tracking

Secure Analysis Source Tools

Static Attribute Security Tokens

18. SQL injection vulnerabilities are typically identified in static analysis by detecting what pattern?

Unsanitized user input concatenated into SQL queries

Use of parameterized statements

Database connection pooling

Network encryption protocols

19. Which tool is commonly used for static Java code analysis?

SonarQube

Burp Suite

Metasploit

Nessus

20. What is a primary advantage of static analysis over dynamic testing?

It can identify vulnerabilities early in the development cycle

It requires no code access

It eliminates the need for security testing

It only finds high-severity vulnerabilities