Exam CS0-002 topic 1 question 36 discussion

Agreed it's A. What is static analysis in cyber security? Image result for static analysis cyber security Static application security testing (SAST), or static analysis, is a testing methodology that analyzes source code to find security vulnerabilities that make your organization's applications susceptible to attack. Regression testing is a software testing practice that ensures an application still functions as expected after any code changes, updates, or improvements. Which would fall into the Security Analyst remit.

Clearly its A

Process of reviewing uncompiled source code either manually or using automated tools -Automated tools can reveal issues ranging from faulty logic to insecure libraries before the app even runs ▪ Code Review ● The process of peer review of uncompiled source code by other developers

Why not B?

Answer from the Course Class

the answer is A A regression test evaluates whether changes in software have caused previously existing functionality to fail

"Unlike many other methods, static analysis does not run the program; instead, it focuses on understanding how the program is written and what the code is intended to do. Static code analysis can be conducted using automated tools or manually by reviewing the code—a process sometimes called “code understanding.” Automated static code analysis can be very effective at finding known issues, and manual static code analysis helps identify programmer-induced errors." Comptia CYSA Dtudy Guide

Regression testing.

Static analysis refers to testing or examining software when it is not running. The most common type of static analysis is code review. Code review is the systematic investigation of the code for security and functional problems. It can take many forms, from simple peer review to formal code review. Code review was covered earlier in this chapter. More on static analysis was covered in Chapter 4.

looks good to me

People who are confused why it is not Dynamic (B) or Regression (C) the keyword here is 'code'. You perform dynamic or regression testing while running the program.

It is not regression testing. Because that is not job of Analyst. Regression testing is in general of QA/Test team. Analyst usually performs either perform static (code scanning) or Dynamic (VA/fuzzing)

A security analyst reviewing code should be done with a Dynamic analysis tool as coding is not a usual strength of security analysts just scripting.

This is indeed a very tricky one. Statistic analysis - code analysis (not software analysis) Regression Testing - Software Test to ensure it functions as it should. Questions asks about examining code and not software, I think here I'll be going with A.

C - Regression testing is testing existing software applications to make sure that a change or addition hasn't broken any existing functionality.

Regression testing is making sure past vulnerabilities are not resurfaced when implementing new code. We are not software developers to pick A...

A. static analysis