Dynamic Application Security Testing (DAST) CASENET Practice Questions (Page 9)

Questions 41–43

1. 41foundation · easy

   What is a best practice for handling authentication when conducting a DAST scan?

   • ARun the scan without authentication to avoid interfering with user sessions
   • BDisable authentication entirely during the scan to speed up the process
   • CProvide valid credentials to the scanner so it can test authenticated areas of the application
   • DUse the same credentials for all users to simplify the scan
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   What is the purpose of validating a vulnerability reported by DAST before remediation?

   • ATo assign a CVSS score to the vulnerability
   • BTo confirm that the vulnerability is real and not a false positive
   • CTo determine the exact line of code that caused the vulnerability
   • DTo check if the vulnerability was already fixed in the latest build
   Reveal Solution Discussion Select an answer first
3. 43expert · hard

   A development team is evaluating security testing tools for a .NET application that is still in development and changes frequently. They need to find vulnerabilities early, but they also want to test the application as users would interact with it. Which combination of testing approaches is most effective?

   • AUse only SAST during development and skip runtime testing to save time.
   • BUse only DAST in production to test the application as users would interact with it.
   • CUse IAST in production to get the benefits of both SAST and DAST.
   • DUse SAST during development to catch code-level issues and DAST in staging to test runtime behavior.
   Reveal Solution Discussion Select an answer first