1. What is Fortify?
a. A network monitoring tool
b. A static application security testing (SAST) tool
c. A dynamic application security testing (DAST) tool
d. A database management tool
Answer: b
2. Which programming languages does Fortify primarily support for SAST?
a. JavaScript and HTML
b. Java, .NET, and C/C++
c. Python and Ruby
d. PHP and SQL
Answer: b
3. Which phase of the software development lifecycle (SDLC) is Fortify typically used in?
a. Requirements gathering
b. Design and architecture
c. Coding and development
d. Testing and deployment
Answer: c
4. What is the main goal of Fortify SAST?
a. Identifying vulnerabilities in source code
b. Monitoring network traffic
c. Ensuring database integrity
d. Load testing applications
Answer: a
5. Which type of vulnerabilities can Fortify SAST detect?
a. Network vulnerabilities
b. SQL injection vulnerabilities
c. Memory leaks
d. Social engineering attacks
Answer: b
6. What does Fortify DAST focus on?
a. Analyzing source code
b. Scanning running applications
c. Securing databases
d. Network monitoring
Answer: b
7. What is the primary purpose of Fortify WebInspect?
a. Static code analysis
b. Dynamic application security testing
c. Penetration testing
d. Database scanning
Answer: b
8. Which of the following is NOT a common Fortify component?
a. Fortify SCA
b. Fortify SSC
c. Fortify WebInspect
d. Fortify Firewall
Answer: d
9. Which stage of the CI/CD pipeline is Fortify best integrated into?
a. Development
b. Testing
c. Deployment
d. Monitoring
Answer: b
10. What does Fortify SSC stand for?
a. Security Scanner Central
b. Software Security Center
c. Secure Software Console
d. Source Code Scanner
Answer: b
11. What is the main benefit of integrating Fortify into a DevSecOps pipeline?
a. Faster code deployment
b. Early detection and remediation of security issues
c. Better user interface design
d. Reduced network latency
Answer: b
12. Which type of report does Fortify typically generate for identified vulnerabilities?
a. SQL report
b. PDF report
c. HTML report
d. JSON report
Answer: c
13. What is the purpose of the Fortify rulepacks?
a. To set up firewalls
b. To define coding standards
c. To manage user permissions
d. To monitor network traffic
Answer: b
14. Which of the following is a common Fortify rulepack category?
a. Network Security
b. Code Encryption
c. User Authentication
d. System Performance
Answer: a
15. How does Fortify help in reducing false positives in security scanning?
a. By eliminating all potential vulnerabilities
b. By using heuristics and pattern matching
c. By blocking all network traffic
d. By slowing down the application
Answer: b
16. Which programming languages are NOT typically supported by Fortify SCA?
a. JavaScript
b. Java
c. C/C++
d. Python
Answer: a
17. What is the primary purpose of Fortify Secure Coding Standards (SCS)?
a. To enforce coding style and formatting
b. To provide guidelines for writing secure code
c. To restrict access to the source code
d. To optimize application performance
Answer: b
18. Which Fortify component is used for dynamic application security testing?
a. Fortify SCA
b. Fortify SSC
c. Fortify WebInspect
d. Fortify Rulepack
Answer: c
19. What does Fortify provide to assist developers in fixing security issues?
a. Code suggestions and remediation guidance
b. Security patches
c. Developer training courses
d. Access to a knowledge base
Answer: a
20. In which phase of the SDLC is dynamic analysis with Fortify WebInspect typically performed?
a. Coding
b. Testing
c. Deployment
d. Requirements gathering
Answer: b
21. What is the primary difference between Fortify SCA and Fortify WebInspect?
a. SCA is a dynamic analysis tool, while WebInspect is a static analysis tool.
b. SCA analyzes source code, while WebInspect scans running applications.
c. SCA is used for network monitoring, while WebInspect is used for database security.
d. SCA focuses on user authentication, while WebInspect deals with encryption.
Answer: b
22. What type of testing is Fortify WebInspect designed for?
a. Load testing
b. Penetration testing
c. Functional testing
d. Usability testing
Answer: b
23. Which Fortify component is used for managing and tracking vulnerabilities?
a. Fortify SCA
b. Fortify SSC
c. Fortify WebInspect
d. Fortify IDE plugin
Answer: b
24. What is the main goal of Fortify Static Code Analyzer (SCA)?
a. Scanning running applications for vulnerabilities
b. Analyzing source code to find vulnerabilities
c. Generating dynamic reports on code performance
d. Optimizing database queries
Answer: b
25. How does Fortify help organizations maintain compliance with security standards and regulations?
a. By providing legal consultation
b. By generating detailed compliance reports
c. By enforcing coding standards
d. By encrypting all data traffic
Answer: b
26. Which security testing method is best suited for identifying vulnerabilities before code is compiled?
a. Penetration testing
b. Static analysis
c. Dynamic analysis
d. Code review
Answer: b
27. What type of vulnerabilities can Fortify WebInspect help detect?
a. Memory leaks
b. SQL injection
c. User authentication issues
d. Network latency
Answer: b
28. What is the role of Fortify in helping organizations establish a DevSecOps culture?
a. Providing free training resources
b. Enforcing strict development timelines
c. Integrating security into the CI/CD pipeline
d. Monitoring employee behavior
Answer: c
29. How does Fortify WebInspect interact with web applications during testing?
a. By performing static analysis
b. By sending malicious payloads to the application
c. By encrypting data in transit
d. By simulating user interactions
Answer: d
30. Which Fortify component focuses on managing and organizing scan results?
a. Fortify SSC
b. Fortify SCA
c. Fortify WebInspect
d. Fortify IDE plugin
Answer: a
31. What is the primary benefit of using Fortify rulepacks in the development process?
a. Reducing code complexity
b. Enforcing security best practices
c. Enhancing user experience
d. Automating deployment processes
Answer: b
32. Which of the following is a critical aspect of Fortify SSC?
a. Generating performance reports
b. Tracking vulnerabilities and their resolution
c. Encrypting sensitive data
d. Managing user authentication
Answer: b
Top comments (0)