Application Assessments and Penetration Testing DSE Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A team is adding DAST to their CI/CD pipeline for a web application. The application requires authentication to access most features. The team wants to scan the authenticated areas during the pipeline without storing credentials in plain text in the repository. What should they do?

   • AHardcode the credentials in the DAST configuration file in the repository for simplicity.
   • BCreate a separate test environment with no authentication so the DAST tool can scan freely.
   • CSkip authentication and only scan the public pages of the application.
   • DStore the credentials as encrypted secrets in the CI system and configure the DAST tool to use them during the scan.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Which of the following best describes how IAST tools operate?

   • AThey scan the application's source code during the build phase
   • BThey are installed as agents within the application to monitor its execution
   • CThey send external HTTP requests to the application without internal visibility
   • DThey analyze package manifests for known vulnerabilities
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A DevSecOps team is integrating SAST into their CI pipeline. They want to fail the build on critical and high severity findings but allow the pipeline to continue for medium and low findings so developers can review them later. The team also needs to ensure that the SAST scan results are available to the security team for tracking. Which approach should they use?

   • ARun SAST only on a nightly schedule and email the report to developers, without integrating it into the CI pipeline.
   • BUse the SAST tool's default configuration, which typically fails the build on all findings, and manually review the report afterward.
   • CRun the SAST scan in a separate stage after the build and always fail the pipeline if any vulnerability is found, regardless of severity.
   • DConfigure the SAST tool to exit with a non-zero code only when critical or high severity vulnerabilities are found, and publish the results as a CI artifact.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Which of the following is a common type of application assessment used in a DevSecOps pipeline?

   • ADatabase performance tuning
   • BStatic Application Security Testing (SAST)
   • CNetwork traffic analysis
   • DUser acceptance testing
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   Which metric is commonly used to track the effectiveness of a security testing program?

   • AMean time to remediate (MTTR) vulnerabilities
   • BNumber of lines of code written per day
   • CTime spent on coffee breaks
   • DNumber of developers on the team
   Reveal Solution Discussion Select an answer first