Dynamic Application Security Testing (DAST) CASENET Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   After a DAST scan, the report shows a critical finding for a cross-site scripting (XSS) vulnerability in a search box. The development team says the input is encoded on output. What should the security team do next?

   • AClose the finding immediately because the developers confirmed the code is safe.
   • BManually verify the finding by reproducing the attack and examining the response to confirm whether the vulnerability is real.
   • CIgnore the finding because DAST is known for false positives.
   • DAsk the developers to change the search box to a dropdown to eliminate the vulnerability.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security team is planning DAST for a .NET application that uses multi-factor authentication (MFA) and has a strict policy that test credentials must not be shared. The scan must run automatically in CI/CD. Which approach best handles authentication for DAST in this environment?

   • AHave the DAST tool generate a new MFA token for each scan using the same shared secret.
   • BAsk a developer to manually log in before each scan and keep the session alive.
   • CUse a dedicated test account with MFA disabled for the test environment and store credentials securely in the CI/CD system.
   • DRun DAST only on unauthenticated pages to avoid the MFA issue.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of Dynamic Application Security Testing (DAST) in a web application security program?

   • ATo instrument the application at runtime to trace data flow and identify vulnerabilities
   • BTo test a running application by simulating attacks and observing its responses
   • CTo analyze source code for vulnerabilities before the application is compiled
   • DTo review the application's architecture and design for security flaws
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A DAST scan is configured to test a web application that uses a REST API. The scanner is only testing the UI pages and not the API endpoints. Which technique should be added to ensure the API is tested?

   • ADisable authentication so the scanner can access the API without credentials.
   • BImport the API specification (e.g., OpenAPI) into the DAST tool to define the endpoints and parameters.
   • CIncrease the scan speed to allow the crawler to find the API endpoints automatically.
   • DUse a different DAST tool that only tests APIs.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is a key advantage of IAST over DAST?

   • AIAST is always faster than DAST because it does not need to crawl the application.
   • BIAST can test the application from the outside without any instrumentation.
   • CIAST can provide more accurate vulnerability details by observing internal data flow and execution paths.
   • DIAST does not require a running application, while DAST does.
   Reveal Solution Discussion Select an answer first