Dynamic Application Security Testing (DAST) CASENET Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security team is configuring DAST for a .NET application that uses CAPTCHA on its login form and other forms. The scanner is unable to submit forms because it cannot solve the CAPTCHA. What is the best approach to handle this?

   • AConfigure the scanner to use a test environment where CAPTCHA is disabled or bypassed, and use valid session credentials for authenticated areas.
   • BUse a CAPTCHA-solving service to automatically solve CAPTCHAs during the scan.
   • CSkip all forms that contain CAPTCHA and test only the rest of the application.
   • DManually test the forms and record the results, then add them to the DAST report.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A development team uses SAST during code commits and wants to add runtime testing. They need to identify vulnerabilities that only appear when the application is running, such as business logic flaws and authentication bypasses. Which approach best complements their existing SAST practice?

   • AReplace SAST with DAST to eliminate the need for source code access.
   • BRun DAST against a staging environment after each deployment to detect runtime vulnerabilities.
   • CUse IAST only, since it combines SAST and DAST features and requires no configuration.
   • DPerform manual penetration testing only, as automated tools cannot detect business logic flaws.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A DAST scan of a web application reports a high number of XSS vulnerabilities, but the development team claims they are false positives because the application uses a strict Content Security Policy (CSP). The security team needs to decide whether to spend time investigating. What is the best course of action?

   • AAccept the development team's claim and close all XSS findings without further investigation.
   • BRemove the CSP header from the application to allow the DAST tool to test for XSS more accurately.
   • CRe-run the DAST scan with a different tool to see if it reports the same findings.
   • DReview the DAST payloads and manually verify a sample of the reported XSS findings to confirm whether they are exploitable despite the CSP.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst is explaining to a developer why DAST is necessary even though the team already uses SAST. Which statement best describes the unique value of DAST?

   • ADAST can analyze the source code to find vulnerabilities before the application is deployed.
   • BDAST is faster and cheaper than SAST, so it should replace SAST entirely.
   • CDAST provides a complete list of all vulnerabilities in the application, eliminating the need for manual testing.
   • DDAST tests the application from the outside, simulating an attacker's perspective and identifying runtime vulnerabilities that SAST cannot detect.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A DAST scan of a .NET application reports an authentication issue where the application does not lock out accounts after multiple failed login attempts. The development team wants to confirm the finding. Which action is most appropriate?

   • AManually attempt multiple failed logins and observe whether the account gets locked.
   • BCheck the server logs for failed login attempts.
   • CRe-run the DAST scan with the same credentials to see if the result is consistent.
   • DReview the login page source code to see if lockout logic is implemented.
   Reveal Solution Discussion Select an answer first