DevSecOps Interview Question

Question 1

What tool do you use for SAST

Answer 1

Fortify or Checkmarx SAST
Sonar
Synk

Question 2

What is SAST tools

Answer 2

Static Application Security Testing (SAST tool)

Question 3

What are SCA tools

Answer 3

Software Composition Analysis (SCA) tools play very important role.
SCA tools help organizations identify and mitigate security vulnerabilities and licensing issues in their software by analyzing third-party components and dependencies.

Question 4

What difference between SCA and SAST tools

Answer 4

SCA is used to identify open source dependencies. SAST is used to analyze proprietary or first-party code. SAST tools do require access to source code, while SCA tools may not. SCA supports open source license compliance and SBOM use cases, while SAST does not.

Question 5

What are SCA tools available

Answer 5

Synk
JFrog XRay
GitHub dependabot
Fossa

Question 6

What are IAST tools

Answer 6

IAST (interactive application security testing) analyzes code for security vulnerabilities while the app is run by an automated test, human tester, or any activity “interacting” with the application functionality.

Question 7

What are example of IAST tools

Answer 7

IAST Tools
Contrast Assess: This tool provides real-time identification and tracking of vulnerabilities during the software development process. It integrates seamlessly into CI/CD pipelines for continuous monitoring and protection.

Invicti: Known for its web application scanning capabilities, Invicti includes IAST features that allow for real-time vulnerability detection and reporting.

HCL AppScan: This comprehensive tool combines IAST with other testing methods, offering extensive support for various programming languages and frameworks. It also has DAST capabilities

Synopsys Seeker: This IAST tool focuses on providing detailed insights into vulnerabilities while the application is running, supporting multiple programming languages.

Acunetix: This web application security tool features IAST capabilities, enabling real-time detection of vulnerabilities and integration into automated testing workflows. It also has DAST capabilities

Question 8

What are DAST tools

Answer 8

Dynamic application security testing (DAST) technologies are designed to detect conditions indicative of a security vulnerability in an application in its running state.

Opt for DAST when assessing production applications from an external perspective or when source code access is not available.

Question 9

Give example of DAST tools

Answer 9

Netsparker, Burp Suite Enterprise, OWASP ZAP