Dynamic Application Security Testing (DAST) CASENET Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security engineer is configuring a DAST scan for a new .NET web application that has a login page and a multi-step checkout flow. The scan must reach pages that require an authenticated session. Which configuration step is essential to ensure the scanner can test the authenticated portions of the application?

   • ADisable JavaScript execution in the scanner to avoid triggering anti-bot protections during the login process.
   • BSet the scanner to use only GET requests so that the login form is submitted via query strings.
   • CConfigure the scanner to replay recorded login sequences and maintain session cookies during the scan.
   • DProvide the scanner with the database credentials so it can directly query user sessions.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is a common vulnerability that DAST can identify by examining HTTP responses?

   • AHardcoded encryption keys
   • BCross-Site Scripting (XSS)
   • CWeak password hashing algorithm in the database
   • DInsecure direct object references in the source code
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security team is about to run a DAST scan on a .NET application that has both a public-facing marketing site and an authenticated admin portal. The scan is scheduled during business hours. Which scoping practice is most important to avoid disrupting operations?

   • AConfigure the scan to exclude the admin portal to avoid locking out administrators during business hours.
   • BLimit the scan to the admin portal and exclude the marketing site to reduce the scan duration.
   • CRun the scan on a staging copy of the application to avoid impacting production systems.
   • DRun the scan only on the login page of the admin portal to minimize the number of requests.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A DAST scan report lists the following findings: a SQL injection in a legacy search page, a missing HTTP security header, and a low-severity information disclosure in an error page. The team has limited time to remediate. Which finding should be prioritized first?

   • AMissing HTTP security header, because it is easy to fix.
   • BAll findings equally, because every vulnerability must be fixed.
   • CSQL injection, because it can lead to data breach and has high impact.
   • DInformation disclosure, because it is the most specific finding.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which technique is commonly used by DAST tools to discover the attack surface of a web application?

   • ACrawling
   • BPenetration testing
   • CFuzzing
   • DStatic analysis
   Reveal Solution Discussion Select an answer first