Application Assessments and Penetration Testing DSE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary characteristic of Interactive Application Security Testing (IAST)?

   • AIt only tests the application from the outside without internal visibility
   • BIt scans open-source dependencies for known vulnerabilities
   • CIt only analyzes source code without execution
   • DIt combines static and dynamic analysis techniques in real-time
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A team integrates SAST, DAST, and SCA into their CI pipeline. They notice that the pipeline is becoming slow and developers are complaining about long feedback times. They want to maintain security coverage while improving pipeline performance. What is the best approach?

   • ARun SAST and SCA on every commit, and run DAST only on deployment to staging.
   • BRun DAST on every commit and SAST only on release candidates.
   • CRun all three tools on every commit to maximize coverage.
   • DRemove SAST from the pipeline because DAST covers everything.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What does a Dynamic Application Security Testing (DAST) tool do?

   • AAnalyzes source code for vulnerabilities without executing it
   • BMonitors application performance in production
   • CScans open-source libraries for known vulnerabilities
   • DTests a running application by sending malicious inputs and analyzing responses
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A development team is evaluating security testing tools for a Java application that is deployed to a test environment. They need to identify vulnerabilities that occur during runtime, such as SQL injection and authentication flaws, and also want to trace them back to the specific source code lines. Which tool type should they choose?

   • AIAST (Interactive Application Security Testing)
   • BSCA (Software Composition Analysis)
   • CDAST (Dynamic Application Security Testing)
   • DSAST (Static Application Security Testing)
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is a common way to integrate security testing tools into a CI/CD pipeline?

   • ABy using them only in production
   • BBy installing them on every developer's machine
   • CBy adding them as stages or steps in the pipeline using plugins or scripts
   • DBy running them manually after each release
   Reveal Solution Discussion Select an answer first