Multiple choice technology security

How many of following are security code review tools

  • OWASP WebScarab
  • Fortify
  • WebInspect
  • AppScan
  • Nikto
  • FindBugs

  1. 1

  2. 2

  3. 4

  4. 6
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

Security code review tools analyze source code for vulnerabilities. Fortify (now Fortify Static Code Analyzer) and FindBugs (static analysis for Java) are genuine code review tools. OWASP WebScarab is a web application security assessment proxy, not a code review tool. WebInspect and AppScan are dynamic/black-box web application scanners, not code review tools. Nikto is a web server scanner.

AI explanation

To answer this question, we need to identify the security code review tools among the given options. Let's go through each option to determine whether it is a security code review tool:

Option A) OWASP WebScarab - OWASP WebScarab is a security testing tool but not specifically a security code review tool. It focuses on intercepting and modifying HTTP/S traffic between a web application and the browser. Therefore, it is not a security code review tool.

Option B) Fortify - Fortify is a well-known security code review tool. It is designed to identify security vulnerabilities in source code and provides developers with guidance on how to fix them. Therefore, Fortify is a security code review tool.

Option C) WebInspect - WebInspect is a web application security testing tool, but it is not primarily used for code review. It focuses on identifying vulnerabilities and security weaknesses in web applications, including those in runtime. Therefore, it is not a security code review tool.

Option D) AppScan - AppScan, also known as IBM Security AppScan, is a web application security testing tool. Similar to WebInspect, it is not primarily used for code review. It scans web applications for vulnerabilities and provides a comprehensive report. Therefore, it is not a security code review tool.

Option E) Nikto - Nikto is an open-source web server vulnerability scanner. It is designed to scan web servers and identify security issues such as outdated software, misconfigurations, and common vulnerabilities. While it is a useful security testing tool, it is not a security code review tool.

Option F) FindBugs - FindBugs is a static analysis tool used for finding bugs and potential vulnerabilities in Java programs. It is not primarily focused on security-specific issues. Therefore, it is not a security code review tool.

Based on the explanations above, out of the given options, only two are security code review tools:

B) Fortify

Keep practicing — related questions