Static and Dynamic Application Security Testing (SAST and DAST) CASEJAVA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following best describes the role of DAST in the software development lifecycle?

   • AIt validates that the application behaves securely in a running environment, often in staging or production-like environments.
   • BIt replaces the need for manual penetration testing entirely.
   • CIt analyzes source code to find vulnerabilities before the application is compiled.
   • DIt is used only during the requirements phase to identify security requirements.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   At which stage of the SDLC can SAST be integrated to provide the earliest feedback to developers?

   • AOnly during the annual security audit.
   • BPost-deployment, by scanning the production environment.
   • COnly after the application is retired.
   • DPre-commit, by running SAST on the developer's local machine or as a pre-commit hook.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Why is it necessary to use both SAST and DAST in a comprehensive security testing program?

   • ABecause DAST cannot find any vulnerabilities and SAST is the only effective method.
   • BBecause SAST is only for production and DAST is only for development.
   • CBecause each method has coverage gaps that the other can fill, providing a more complete view of the application's security posture.
   • DBecause SAST is only for web applications and DAST is only for mobile applications.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security tester is using a DAST tool to test a Java web application. The tool automatically discovers new endpoints by following links and submitting forms, then sends a large number of malformed inputs to those endpoints to trigger unexpected behavior. Which two DAST techniques are being used?

   • ACode review and penetration testing
   • BStatic analysis and dynamic analysis
   • CCrawling and fuzzing
   • DTaint analysis and data flow analysis
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team wants to identify vulnerabilities that only appear when the application is fully deployed with its production configuration, such as misconfigured security headers and authentication logic that depends on the runtime environment. Which testing approach should they use?

   • ADependency scanning of the build artifacts
   • BSAST with taint analysis on the source code
   • CManual code review focusing on authentication logic
   • DDAST against a staging environment that mirrors production
   Reveal Solution Discussion Select an answer first