A company wants to integrate DAST into its CI/CD pipeline. The application is deployed to a staging environment after every merge to main. Which approach ensures continuous security testing without blocking critical releases?

Run a full DAST scan on the staging environment after each deployment and fail the pipeline only on critical findings.

Run DAST once a month on the staging environment to reduce resource usage.

Run DAST only on production after each release to avoid slowing down the development pipeline.

Run DAST on the developer's local machine before code is committed.

What is a recommended practice for scheduling DAST scans in a CI/CD pipeline?

Run DAST scans on every build to catch vulnerabilities early and continuously

Run DAST scans only once before the final release

Run DAST scans manually on an ad-hoc basis

Run DAST scans only when a security incident occurs

What is a common strategy to mitigate the limitation of DAST coverage gaps?

Increasing the scan speed to cover more pages

Running DAST only on the production environment

Disabling authentication to allow the scanner to access all pages

Using DAST in combination with SAST and manual testing

A security engineer is configuring a DAST tool for a web application that requires authenticated scanning. The application uses a JavaScript-heavy single-page application (SPA) that renders most content dynamically. The engineer needs to ensure the scanner can reach all functional areas and test for injection and XSS. Which configuration step is most critical for the scanner to effectively test the application?

Use a simple HTTP crawler that follows only static HTML links to map the application.

Configure the scanner with valid session credentials and enable a browser-based crawler that can execute JavaScript.

Disable JavaScript execution in the scanner to speed up the crawl and reduce resource usage.

Set the scanner to perform only unauthenticated scans to avoid affecting the application's session state.

Which of the following vulnerabilities is DAST specifically designed to detect by sending crafted input to application parameters?

Hardcoded credentials in source code

Insecure deserialization in the code

Missing input validation in the source code

EC-CouncilCertified Application Security Engineer (.NET)

Domain 8Objective 2

Dynamic Application Security Testing (DAST) CASENET Practice Questions (Page 5)

Part of the Security Testing and Secure Deployment domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 21–25

21application · medium
A company wants to integrate DAST into its CI/CD pipeline. The application is deployed to a staging environment after every merge to main. Which approach ensures continuous security testing without blocking critical releases?
Select an answer first
22foundation · easy
What is a recommended practice for scheduling DAST scans in a CI/CD pipeline?
Select an answer first
23foundation · easy
What is a common strategy to mitigate the limitation of DAST coverage gaps?
Select an answer first
24application · medium
A security engineer is configuring a DAST tool for a web application that requires authenticated scanning. The application uses a JavaScript-heavy single-page application (SPA) that renders most content dynamically. The engineer needs to ensure the scanner can reach all functional areas and test for injection and XSS. Which configuration step is most critical for the scanner to effectively test the application?
Select an answer first
25foundation · easy
Which of the following vulnerabilities is DAST specifically designed to detect by sending crafted input to application parameters?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.