Dynamic Application Security Testing (DAST) CASENET Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a known limitation of DAST?

   • AIt requires access to the source code to function
   • BIt cannot test the application's runtime behavior
   • CIt may not cover all code paths, especially those requiring complex authentication or specific user roles
   • DIt can only detect vulnerabilities in the client-side code
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A DAST scan of a .NET application reports a high number of SQL injection alerts, but the development team insists the application uses parameterized queries everywhere. What is the most likely cause of these false positives?

   • AThe scanner is sending payloads that are interpreted by the application's error handling as SQL errors, even though the queries are parameterized.
   • BThe application is using an ORM that does not parameterize queries, so the developers are mistaken.
   • CThe scanner is configured to test only GET requests, missing the actual SQL injection points in POST requests.
   • DThe scanner is testing the application with invalid authentication tokens, causing all requests to fail and be reported as vulnerabilities.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A DAST scan report lists a potential SQL injection vulnerability with a 'High' severity, but the security team has limited resources and must decide which findings to remediate first. The report also includes several 'Medium' XSS findings and a 'Low' information disclosure finding. How should the team prioritize?

   • ARemediate all findings at the same time, regardless of severity, to ensure complete security.
   • BInvestigate the SQL injection first, as it has the highest potential impact, then address the XSS findings, and finally the information disclosure.
   • CIgnore the SQL injection because it is likely a false positive, and focus on the XSS findings.
   • DFocus only on the XSS findings because they are more common and easier to exploit.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A DAST scanner is configured to test a .NET web application. The scanner has completed crawling and is now sending unexpected input to various parameters to see if the application handles it securely. Which DAST technique is being used?

   • APassive scanning
   • BCrawling
   • CAuthentication testing
   • DFuzzing
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company wants to integrate DAST into its CI/CD pipeline but is concerned about scan time and false positives blocking releases. The application is large and has many endpoints. Which strategy best balances security testing with release velocity?

   • ARun a full DAST scan on every build and fail the pipeline on any finding.
   • BRun DAST manually once a month to reduce the impact on the pipeline.
   • CRun DAST only on production after each release to avoid slowing down the pipeline.
   • DRun a targeted DAST scan on changed endpoints during each build and a full scan on a nightly schedule.
   Reveal Solution Discussion Select an answer first