DevSecOps Interview Question Flashcards
What tool do you use for SAST
Fortify or Checkmarx SAST
Sonar
Synk
What is SAST tools
Static Application Security Testing (SAST tool)
What are SCA tools
Software Composition Analysis (SCA) tools play very important role.
SCA tools help organizations identify and mitigate security vulnerabilities and licensing issues in their software by analyzing third-party components and dependencies.
What difference between SCA and SAST tools
SCA is used to identify open source dependencies. SAST is used to analyze proprietary or first-party code. SAST tools do require access to source code, while SCA tools may not. SCA supports open source license compliance and SBOM use cases, while SAST does not.
What are SCA tools available
Synk
JFrog XRay
GitHub dependabot
Fossa
What are IAST tools
IAST (interactive application security testing) analyzes code for security vulnerabilities while the app is run by an automated test, human tester, or any activity “interacting” with the application functionality.
What are example of IAST tools
Contrast Security Assess or Synopsys Seeker
What are DAST tools
Dynamic application security testing (DAST) technologies are designed to detect conditions indicative of a security vulnerability in an application in its running state.
What are DAST tools
Netsparker, Burp Suite Enterprise, OWASP ZAP