Application Assessments and Penetration Testing DSE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A DevSecOps team has a pipeline that runs SAST and SCA. The SAST tool reports a critical vulnerability in custom code, and the SCA tool reports a critical vulnerability in a third-party library. The team has limited development capacity and can fix only one this sprint. The custom code vulnerability is not exposed to the internet, while the library vulnerability is actively exploited in the wild. Which vulnerability should they remediate first?

   • ANeither, because they are both only reported by automated tools.
   • BThe library vulnerability, because it is actively exploited and has a known exploit path.
   • CThe custom code vulnerability, because it is rated critical by SAST.
   • DBoth at the same time, even if it means delaying the sprint.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An organization wants to include penetration testing in its CI/CD pipeline but cannot run a full manual pen test on every commit due to time and cost. They need a way to catch obvious exploitable issues automatically while still scheduling deeper manual tests. Which approach best balances automation and thoroughness?

   • ARun only SAST scans and skip dynamic testing entirely.
   • BRun a full manual penetration test on every commit and block the pipeline until it passes.
   • CPerform penetration testing only after production deployment.
   • DRun automated DAST scans on every build and schedule manual penetration tests on release candidates.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A DevSecOps team wants to catch security defects as early as possible in the CI pipeline. They have a Java application built with Maven and want to fail the build on critical vulnerabilities without slowing down the pipeline. Which approach best meets this requirement?

   • APerform a manual penetration test once per release and track findings in an issue tracker.
   • BUse an SCA tool to scan only production dependencies and generate a license report.
   • CRun a SAST tool as a Maven plugin during the compile phase and fail the build on critical findings.
   • DRun a DAST scan against a staging environment after deployment and report findings to the team.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company is using an open-source library in their application. The SCA scan reports that the library has a known critical vulnerability, but the library is no longer maintained and there is no patched version available. The team needs to continue using the library because it is essential to the application's functionality. What should they do?

   • ARemove the library immediately and rewrite the functionality from scratch.
   • BIgnore the vulnerability because the library is open-source and widely used.
   • CDocument the risk, apply compensating controls such as network restrictions or input validation, and track the issue for periodic review.
   • DUpgrade to the latest version of the library, even though it is not a patched version.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is a common way to automate parts of penetration testing in a CI/CD pipeline?

   • ASkipping penetration testing if SAST and DAST pass
   • BRunning penetration tests only in production
   • CRunning automated DAST scans and using scripts to launch common attack patterns
   • DReplacing all manual testers with automated tools
   Reveal Solution Discussion Select an answer first