IBM Security AppScan Source Edition Implementation

You are reviewing an online shopping application and find a lost sink method called combineltemListsf..,) that is provided by a third-party shopping framework. This method combines two lists of items (provided as arguments) into one. Which type of custom rule do you need to create for this method?

How does the "Single virtual call" setting affect scan behavior?

 

You are reviewing a banking application and find a lost sink method called performTransactionf...) that sends requested transaction information (bill payment, funds transfer, etc) to the back-end COBOL application running on IBM System z mainframe that actually moves the money. Which type of custom rule should you create for this method?

You are reviewing a thick client application and come upon File Injection findings in a function that opens zip files and extracts data from them, but the customer you are working with tells you that the data is sanitized using a method mySanitizer.validateZip{..). You confirm this and decide to remove this vulnerability and other File injection findings with sanitized data using the Remove functionality of the Trace section in the Filter Editor. In which area of the Trace Rule Entry dialog would you add mySanitizer.validateZip(..) method?

Which view in the Visual Studio IDE Plugin allows a user to focus on results in which they are interested?

What is the proper action to take if the attack surface proves to be insufficient?

How can a user be prevented from creating new custom rules?

Reports in AppScan Source Edition can be exported in which two formats?

Which two AppScan Source components can be used to generate reports?

Which two components are required to install AppScan Enterprise Server with reporting?