MCQs

Disclaimer:

Educational Use Only:

The website links provided are to be used strictly for educational and knowledge-gaining purposes only.

No Misuse:

Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.

Respect for Websites and Businesses:

Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.

Acknowledge Value of Knowledge:

Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.

No Endorsement:

The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.

User Responsibility:

By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.

What does Static Code Analysis detect in cybersecurity?
a. Executed application behavior
b. Source code vulnerabilities without execution
c. Live network traffic
d. External attacks
Answer: b. Source code vulnerabilities without executioncheckmarx+1
Which process analyzes application code at rest?
a. Static Code Analysis
b. Dynamic Code Analysis
c. Network Forensics
d. Penetration Testing
Answer: a. Static Code Analysisvfunction+1
Static Application Security Testing (SAST) focuses on analyzing:
a. Code during execution
b. Application binaries without execution
c. Network protocols
d. Runtime logs
Answer: b. Application binaries without executionblackduck+1
Which testing method is the counterpart to SAST?
a. DAST
b. API testing
c. Load testing
d. Configuration review
Answer: a. DASTcheckmarx+1
The main advantage of static code analysis in early development is:
a. Detecting runtime network threats
b. Preventing vulnerabilities before deployment
c. Monitoring user activity
d. JVM optimization
Answer: b. Preventing vulnerabilities before deploymentexamradar+1
What is the main limitation of static analysis tools?
a. They execute the application
b. They miss runtime behaviors and false positives
c. They require malware samples
d. They can’t analyze source code
Answer: b. They miss runtime behaviors and false positivesexamradar+1
Which type of analysis involves rule-based vulnerability scanning?
a. Data flow analysis
b. Pattern matching
c. Rule-based analysis
d. Semantic mapping
Answer: c. Rule-based analysiswiz
What does lexical analysis verify?
a. Code structure and naming standards
b. Attack payloads
c. Network packet structure
d. Memory leaks
Answer: a. Code structure and naming standardsoligo+1
What type of tool is IDA Pro?
a. Dynamic analysis tool
b. Static analysis disassembler
c. Network sniffer
d. Load testing tool
Answer: b. Static analysis disassemblerexamradar
Static code analysis tools are used primarily by:
a. Penetration testers post-deployment
b. Developers during coding
c. System administrators only
d. QA teams exclusively
Answer: b. Developers during codingcareerride+1
What does control flow analysis track?
a. Program execution order and logic paths
b. Network routes
c. OS kernel calls
d. Firewall rules
Answer: a. Program execution order and logic pathscloudbees+1
Which is a well-known open-source static analyzer?
a. Burp Suite
b. SonarQube
c. Wireshark
d. Nmap
Answer: b. SonarQubeaikido+1
What type of issues can Static Code Analysis identify?
a. SQL injection and buffer overflows
b. Firewall rule misconfigurations
c. Outdated DNS records
d. Server uptime delays
Answer: a. SQL injection and buffer overflowscloudbees+1
Static analysis detects input validation flaws by:
a. Tracing input-handling logic
b. Executing fuzz tests
c. Generating network payloads
d. Modifying runtime states
Answer: a. Tracing input-handling logicsplunk+1
How does Static Code Analysis help with compliance?
a. Ensures adherence to secure coding standards
b. Detects policy violations at runtime
c. Configures cloud permissions
d. Handles user authentication
Answer: a. Ensures adherence to secure coding standardsowasp+1
Static analysis works on:
a. Running applications
b. Source or binary code at rest
c. Running containerized software
d. Encrypted network data
Answer: b. Source or binary code at restveracode+1
Which phase of SDLC benefits most from SAST?
a. Deployment
b. Design and development
c. Maintenance
d. End-user testing
Answer: b. Design and developmentblackduck+1
What does data flow analysis detect?
a. Uninitialized variables and leaks
b. Malware signatures
c. Packet floods
d. DDoS attacks
Answer: a. Uninitialized variables and leakswiz+1
SAST can be integrated into:
a. CI/CD pipelines
b. Firewalls
c. Mobile devices
d. Web servers only
Answer: a. CI/CD pipelinesveracode+1
Security analysis in static testing detects:
a. Cross-site scripting and buffer overflows
b. Password recovery functions
c. Network proxies
d. User session cookies
Answer: a. Cross-site scripting and buffer overflowscloudbees
Which language family is analyzed by Clang?
a. Python
b. C/C++
c. Java
d. Ruby
Answer: b. C/C++cloudbees
Static analysis prevents:
a. Runtime crashes from faulty logic
b. Outdated operating systems
c. Hardware faults
d. UI inconsistencies
Answer: a. Runtime crashes from faulty logicveracode+1
A static code analyzer doesn’t require:
a. Program execution
b. Source code access
c. Developer permissions
d. IDE integration
Answer: a. Program executioncheckmarx+1
Which is a limitation of SAST in isolation?
a. Cannot detect open-source component vulnerabilities
b. Requires no code
c. Monitors runtime CPU usage
d. Eliminates need for audits
Answer: a. Cannot detect open-source component vulnerabilitiescheckmarx
Static analysis detects violations of:
a. Coding standards
b. Network protocols
c. Virtual memory
d. BIOS firmware
Answer: a. Coding standardswiz+1
Software Composition Analysis focuses on:
a. Open-source dependencies
b. Runtime execution flow
c. Binary unpacking
d. Compiler performance
Answer: a. Open-source dependenciesblackduck+1
What term refers to the process of breaking down syntax trees?
a. Parsing
b. Tokenization
c. Interpretation
d. Patching
Answer: a. Parsingoligo
Which approach can reduce false positives?
a. Combining SAST and DAST
b. Running SAST only
c. Enabling debugging
d. Excluding code scanning
Answer: a. Combining SAST and DASTveracode+1
What is symbolic execution in analysis?
a. Evaluating paths with symbolic inputs
b. Testing deployed code
c. Tracking network sockets
d. Encrypting source code
Answer: a. Evaluating paths with symbolic inputsoligo
Which technique identifies control structure anomalies?
a. Control flow analysis
b. Semantic analysis
c. Lexical analysis
d. Pattern matching
Answer: a. Control flow analysisoligo+1
Which type of analysis helps track variable initialization?
a. Data flow analysis
b. Packet tracing
c. Code refactoring
d. Policy mapping
Answer: a. Data flow analysiswiz+1
What element of code quality is most affected by static analysis?
a. Maintainability
b. Execution speed
c. Hardware compatibility
d. API response time
Answer: a. Maintainabilitycloudbees+1
What tool is used to discover insecure coding patterns using regex?
a. SemGrep
b. Nessus
c. Metasploit
d. Splunk
Answer: a. SemGrepaikido+1
What result can static analysis tools display in IDEs?
a. Compile-time syntax errors
b. Load testing graphs
c. CPU metrics
d. Firewall logs
Answer: a. Compile-time syntax errorscloudbees
What is the role of mutation testing in white box testing?
a. Detect code robustness
b. Capture malware payloads
c. Test encryption schemes
d. Analyze external inputs
Answer: a. Detect code robustnessstudocu
Static analysis tools can detect:
a. Dead code
b. DNS poisoning
c. Phishing campaigns
d. Authentication bypass
Answer: a. Dead codecareerride+1
Why do developers embed static analysis in CI/CD?
a. To ensure security with minimal disruption
b. To execute malware tests
c. To bypass debugging
d. To simulate network load
Answer: a. To ensure security with minimal disruptionwiz
Which aspect of security is improved by static code analysis?
a. Code hygiene
b. Packet encryption
c. Firewall hardening
d. Password creation
Answer: a. Code hygienecheckmarx+1
What is the goal of symbolic execution?
a. Explore all code execution paths
b. Minimize network data usage
c. Encrypt source files
d. Generate logs
Answer: a. Explore all code execution pathsoligo
What kind of vulnerabilities can be found in static analysis reports?
a. Buffer overflow
b. VPN leak
c. Misconfigured DNS
d. Traffic shaping
Answer: a. Buffer overflowcheckmarx+1
SAST can analyze which code form besides source code?
a. Bytecode
b. Configuration
c. Log files
d. Password lists
Answer: a. Bytecodeveracode+1
Static code analysis supports which programming practice?
a. Secure coding
b. Network isolation
c. Host firewalling
d. Patch management
Answer: a. Secure codingcheckmarx+1
In static analysis, which errors are caught before compilation?
a. Syntax errors
b. Runtime exceptions
c. Network latency
d. File permission changes
Answer: a. Syntax errorscloudbees
Which tool combines automated SAST and cloud scanning?
a. Veracode
b. Wireshark
c. Hydra
d. Nmap
Answer: a. Veracodeaikido+1
What does static code analysis reduce in SDLC?
a. Technical debt
b. Patch deployment time
c. Execution latency
d. DNS lag
Answer: a. Technical debtveracode+1
The main characteristic of static code analysis is:
a. Examination without execution
b. Review during live testing
c. Runtime debugging
d. Memory allocation
Answer: a. Examination without executionexamradar+1
What is a disadvantage of static analysis?
a. False positives
b. No source code visibility
c. Slow compilation
d. Hardware dependency
Answer: a. False positivesexamradar+1
Static analysis tools output often includes:
a. Vulnerability reports
b. Packet captures
c. User session logs
d. Database schemas
Answer: a. Vulnerability reportsveracode+1
Which static code technique enforces consistent indentation and naming?
a. Syntax analysis
b. Control flow tracing
c. Semantic execution
d. Data validation
Answer: a. Syntax analysisoligo+1
Why is static analysis considered proactive?
a. It detects issues before runtime exploitation
b. It logs incidents after attacks
c. It records event traces
d. It inspects network streams
Answer: a. It detects issues before runtime exploitationcheckmarx+1

Blog

Systemethic Technologies

Leave a Reply Cancel reply

Useful links

Other Terms & Policies

Contact Info