Application Assessments and Penetration Testing DSE Practice Questions (Page 11)

Questions 51–52

1. 51expert · hard · select all that apply

   A security team is planning to integrate penetration testing into their CI/CD pipeline. They want to balance automation with manual expertise and ensure findings are tracked. Which of the following practices should they adopt? (Select all that apply.)

   • ADisable automated scans after a manual pen test is completed.
   • BRun manual penetration tests on every commit to ensure maximum coverage.
   • CSchedule manual penetration tests on release candidates to uncover complex logic flaws.
   • DRun automated DAST scans on every build to catch common vulnerabilities.
   • EAutomatically file findings from pen tests into an issue tracker with severity and remediation guidance.
   Check answers Discussion Select an answer first
2. 52application · medium

   A team deploys a web application to a staging environment and wants to automatically test the running application for common web vulnerabilities such as SQL injection and XSS. They need the scan to run in the CI pipeline after deployment and produce a report that can be reviewed. Which tool category should they integrate?

   • ASCA
   • BIAST
   • CSAST
   • DDAST
   Reveal Solution Discussion Select an answer first