Which type of vulnerability is DAST most likely to detect that SAST would miss?

A hardcoded API key in the source code

A SQL injection flaw in a stored procedure

A logic flaw in the business layer that requires a specific sequence of user actions

A misconfigured HTTP security header that is only visible when the application is running

A development team is debating when to run security testing for a .NET web API. They want to catch vulnerabilities early but also need to identify runtime issues that only appear when the application is running. Which approach best combines early detection with runtime validation?

Use IAST exclusively and skip both SAST and DAST to reduce tooling overhead.

Run SAST during code commits and DAST against a staging environment after deployment.

Run SAST only after the code is deployed to production to analyze the final build.

Run DAST only in production after every release to test the live environment.

A development team is adopting a security testing program for a .NET web application. They have limited budget and need to choose between SAST, DAST, and IAST. The application is in active development with frequent code changes, and they need to catch vulnerabilities as early as possible while also identifying runtime issues. Which combination of tools best meets their needs?

Use SAST only because it is the most cost-effective and can find all vulnerabilities.

Use SAST in the CI pipeline for early detection and DAST on a staging environment for runtime validation.

Use IAST exclusively because it combines the benefits of SAST and DAST in a single tool.

Use DAST only because it tests the application as an attacker would, providing the most realistic results.

What is the purpose of fuzzing in a DAST scan?

To analyze the source code for potential vulnerabilities

To authenticate to the application with valid credentials

To discover all the pages and endpoints of the application

To send malformed or unexpected inputs to application inputs to trigger unexpected behavior or crashes

After running a DAST scan, the report lists a high number of SQL injection alerts on a search endpoint. The development team manually verified that the endpoint uses parameterized queries and is not vulnerable. What is the most likely reason for these false positives, and what should the team do?

The scanner sent malformed payloads that the application safely rejected; the team should review the scanner's attack patterns and adjust the scan configuration.

The scanner requires database access to confirm the vulnerability; the team should provide read-only credentials.

The scanner detected a real vulnerability that the developers missed; the team should immediately patch the endpoint.

The scanner is outdated and cannot recognize parameterized queries; the team should upgrade to the latest version.

EC-CouncilCertified Application Security Engineer (.NET)

Domain 8Objective 2

Dynamic Application Security Testing (DAST) CASENET Practice Questions (Page 1)

Part of the Security Testing and Secure Deployment domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 1–5

1foundation · easy
Which type of vulnerability is DAST most likely to detect that SAST would miss?
Select an answer first
2application · medium
A development team is debating when to run security testing for a .NET web API. They want to catch vulnerabilities early but also need to identify runtime issues that only appear when the application is running. Which approach best combines early detection with runtime validation?
Select an answer first
3expert · hard
A development team is adopting a security testing program for a .NET web application. They have limited budget and need to choose between SAST, DAST, and IAST. The application is in active development with frequent code changes, and they need to catch vulnerabilities as early as possible while also identifying runtime issues. Which combination of tools best meets their needs?
Select an answer first
4foundation · easy
What is the purpose of fuzzing in a DAST scan?
Select an answer first
5application · medium
After running a DAST scan, the report lists a high number of SQL injection alerts on a search endpoint. The development team manually verified that the endpoint uses parameterized queries and is not vulnerable. What is the most likely reason for these false positives, and what should the team do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.