Application Assessments and Penetration Testing DSE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   In a CI/CD pipeline, what is a common role of DAST?

   • ATo test the deployed application in a staging environment for runtime vulnerabilities
   • BTo replace the need for penetration testing entirely
   • CTo analyze source code during the commit stage
   • DTo manage open-source licenses
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   In a DevSecOps pipeline, what is the primary purpose of application assessments?

   • ATo ensure the application meets functional requirements and user expectations
   • BTo identify and remediate security vulnerabilities early in the software development lifecycle
   • CTo replace the need for manual code reviews by developers
   • DTo automatically fix all security vulnerabilities without developer intervention
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A team is designing a new microservices-based application. They want to identify threats early in the design phase, but they have limited time and need to focus on the most critical components. They also want to ensure that the threat model is updated as the architecture evolves. What is the best approach?

   • ASkip threat modeling and rely on SAST scans to find threats.
   • BPerform a single threat model for the entire system at the start and never update it.
   • CPerform threat modeling on each microservice during design, prioritizing those handling sensitive data, and review the model in each sprint.
   • DPerform threat modeling only after the application is deployed.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the primary goal of threat modeling for an application?

   • ATo design the user interface and user experience for the application
   • BTo identify and document potential security threats to the application
   • CTo test the application for vulnerabilities using automated tools
   • DTo monitor application performance in production
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A security team wants to automate penetration testing in their CI/CD pipeline. They have a staging environment that is only available during business hours. The penetration test takes about 4 hours to complete. The team wants to run the test automatically without manual intervention and without impacting the release pipeline. What is the best approach?

   • ARun the penetration test as a stage in the main pipeline before deployment to production.
   • BRun the penetration test in parallel with the production release.
   • CSchedule the penetration test as a nightly job that runs against the staging environment, and trigger it only when the environment is available.
   • DRun the penetration test manually once a month.
   Reveal Solution Discussion Select an answer first