Past questions › sample-q8
2025 2 marks Short answer Secure Software Architecture (Year 12) SAST and DAST
NESA HSC Software Engineering Sample Examination + Marking Guidelines (official, 2025)
The strategies below can be used to test the security of a web application that contains a database. Classify each as EITHER SAST OR DAST: (1) Simulate attacks on the web application; (2) Check the way SQL queries are constructed; (3) Test the database's web interface for vulnerabilities; (4) Test the web application used to interact with the database when it is running; (5) Analyse the code for connecting to the database to identify security vulnerabilities.
Marking criteria
2: Correctly classifies all the strategies. 1: Correctly classifies THREE strategies, which must include ONE SAST and ONE DAST.
Sample answer
SAST: (2) and (5). DAST: (1), (3) and (4).