Application Assessments and Penetration Testing DSE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which factor is most important when prioritizing vulnerabilities for remediation?

   • AThe number of lines of code in the affected module
   • BThe developer who wrote the code
   • CThe severity of the vulnerability and the risk it poses to the organization
   • DThe age of the vulnerability
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A development team uses many open-source libraries in a Node.js project. They want to automatically detect known vulnerabilities in those libraries and also check for license compliance before each release. Which tool should they add to their CI pipeline?

   • ASCA tool
   • BSAST tool
   • CDAST tool
   • DIAST tool
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A team is deploying a web application to a staging environment. They want to run DAST as part of the pipeline to identify vulnerabilities before production release. The DAST scan requires the application to be running and accessible. At which stage should they run the DAST scan?

   • ADuring the build stage, before the application is deployed.
   • BAfter the application is deployed to the staging environment, before the production release.
   • CAfter the production release, to test the live application.
   • DDuring the code commit stage, before the build.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A DevSecOps team uses SAST and SCA in their pipeline. The SAST tool reports a medium-severity vulnerability in the application code, and the SCA tool reports a high-severity vulnerability in a widely used open-source library. The team has limited development capacity. Which vulnerability should they address first?

   • ANeither, because the pipeline passed and the vulnerabilities are not blocking.
   • BThe high-severity library vulnerability, because it has a higher severity rating and may have a known exploit.
   • CBoth at the same time, because they are both vulnerabilities.
   • DThe medium-severity code vulnerability, because it is in the application's own code and easier to fix.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is developing a new customer-facing web application. They want to identify vulnerabilities early in development and also validate that the deployed application is secure before launch. Which combination of assessment types should they include in their DevSecOps pipeline?

   • AOnly SAST on the final release code.
   • BOnly manual penetration testing after launch.
   • CSAST during development and DAST on the staging environment before launch.
   • DOnly DAST after production deployment.
   Reveal Solution Discussion Select an answer first