Dynamic Application Security Testing (DAST) CASENET Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A DAST scan report shows a critical SQL injection vulnerability in a search endpoint. The development team has already fixed the issue and deployed the fix to production. The security team wants to confirm the fix. What is the most reliable way to verify the remediation?

   • ARe-run the DAST scan against the production endpoint and confirm that the specific SQL injection finding is no longer reported.
   • BReview the code changes in the repository to ensure the fix is correct.
   • CAsk the developer to confirm that the fix was deployed.
   • DRun a full DAST scan on the entire application to ensure no other vulnerabilities exist.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   At which stage of the SDLC is DAST most effectively integrated to provide continuous security testing?

   • ADuring the coding phase
   • BDuring the testing phase and in CI/CD pipelines
   • CDuring requirements gathering
   • DDuring the design phase
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A DAST scan of a .NET application reports a reflected XSS vulnerability in a search results page. The development team wants to confirm the finding before fixing it. Which action best validates the DAST result?

   • AReview the source code to see if output encoding is used.
   • BCheck the server logs to see if the payload was logged.
   • CManually reproduce the vulnerability by submitting a crafted payload and observing the response.
   • DRe-run the DAST scan with the same configuration to see if the result is consistent.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   When analyzing a DAST scan report, which factor should be prioritized when deciding which vulnerability to remediate first?

   • AThe number of lines of code affected
   • BThe order in which the vulnerabilities were discovered
   • CThe name of the tool that found the vulnerability
   • DThe severity rating and the exploitability of the vulnerability
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A DAST scan is being configured for a .NET application that uses a search feature with a parameter called 'q'. The scanner is not testing the search parameter with malicious payloads. Which technique should be used to ensure the parameter is fuzzed?

   • AIncrease the scan speed to allow the scanner to fuzz more parameters automatically.
   • BDefine the parameter in the scan configuration so the scanner knows to fuzz it.
   • CUse a different DAST tool that fuzzes all parameters by default.
   • DDisable the search feature during the scan to avoid false positives.
   Reveal Solution Discussion Select an answer first