TK Study
HomeLearn step by stepMemoriseKey termsFlashcardsNotesMaster answersPast questionsMultiple choiceMock examPractice & marker

Software Engineering › Learn step by step › Y12 Secure Software Architecture

Item 204 of 426 · Year 12: Secure Software Architecture, 27 of 57

Static application security testing (SAST)

Term Key terms bank

Jump to a topic
  1. Exam format, question types and command words (46)
  2. Year 11: Programming Fundamentals (69)
  3. Year 11: The Object-Oriented Paradigm (33)
  4. Year 11: Programming Mechatronics (29)
  5. Year 12: Secure Software Architecture (57)
  6. Year 12: Programming for the Web (59)
  7. Year 12: Software Automation (35)
  8. Year 12: The Software Engineering Project (47)
  9. Diagrams and modelling tools (18)
  10. Python, SQL, pseudocode and CSS patterns (33)

See every item in the sequence

Definition

Analysing the source code without running it to find security flaws early in development; a white box method.

Example: SAST = code NOT running, source visible, early. DAST = program running, from outside, finds runtime flaws.

Found in: syllabus, school notes.

Short version to memorise (key terms bank)

Static application security testing of source code without running it.

Where you'll use it in the test

Syllabus area: Y12 Secure Software Architecture.

Question types it can appear in

Where it has appeared in the paper

Secure Software Architecture (Part A, B). Part letters follow each paper’s own layout.

Related past questions

How to use it

A model sentence

General advice, built from the definition and example above

“Analysing the source code without running it to find security flaws early in development; a white box method.” Then apply it: SAST = code NOT running, source visible, early. DAST = program running, from outside, finds runtime flaws.

In a short answer, give the definition in your own words first, then tie it to the situation in the question. Do not copy the example above unless it fits the scenario.

Command words used with it

From the linked past questions
  • Classify: Arrange or include in classes or categories. (Sample exam Q8 (2 marks): SAST and DAST)
  • Analyse: Identify components and the relationship between them; draw out and relate implications. (Sample exam Q8 (2 marks): SAST and DAST)

Official worked answer

Sample exam Q8 (2 marks): SAST and DAST (2 marks): official criteria and sample answer

Criteria

2: Correctly classifies all the strategies. 1: Correctly classifies THREE strategies, which must include ONE SAST and ONE DAST.

Sample answer

SAST: (2) and (5). DAST: (1), (3) and (4).

Open the question page

Go deeper

Check yourself

Explain “Static application security testing (SAST)” in one sentence, give an example, and name a question type that could test it.

Reveal the answer

Analysing the source code without running it to find security flaws early in development; a white box method.

Example: SAST = code NOT running, source visible, early. DAST = program running, from outside, finds runtime flaws.

Could be tested as: Matching or table, Multiple choice, Fill in the blanks, Short answer.

Quick multiple choice

Which statement correctly contrasts SAST and DAST?

  1. Both can only be done after the software is installed
  2. SAST analyses source code without running it; DAST tests the running application from the outside
  3. SAST tests the running application; DAST analyses source code without running it
  4. SAST needs a human attacker; DAST never does
Show the answer

B

Static = code at rest. Dynamic = software while it runs (e.g. simulated attacks).

Source: original (written for this study pack; not a NESA question). Open it in the multiple-choice bank.