Application Assessments and Penetration Testing DSE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A SAST scan in the CI pipeline reports hundreds of vulnerabilities. The team cannot fix all of them immediately. They want to prioritize remediation based on risk and track progress. Which approach should they take?

   • AFix all vulnerabilities in alphabetical order of the affected file.
   • BAutomatically fail the build on any vulnerability without prioritization.
   • CDisable the SAST scan to avoid the noise.
   • DPrioritize by CVSS score and exploitability, then track remediation in an issue tracker with SLAs.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A team is developing a new web application that will handle user payments. They want to identify potential security threats early in the development process, before writing code. Which activity should they perform?

   • ADeploy the application to production and run a penetration test.
   • BWait until the application is complete and then perform a DAST scan.
   • CRun a SAST scan on the existing codebase.
   • DConduct a threat modeling session using a structured approach like STRIDE or PASTA.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   After a series of security assessments, a security lead needs to communicate the overall risk posture to executives who are not technical. They want to show trends over time and highlight the most critical issues. What is the most effective way to present this information?

   • AA detailed penetration test report with exploit steps.
   • BA dashboard with vulnerability counts by severity and a trend line over releases.
   • CA raw list of all CVEs with technical descriptions.
   • DAn email with the number of open vulnerabilities and no context.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A team wants to automatically scan a web application for vulnerabilities after each deployment to a test environment. They need the scan to be triggered by the CI/CD pipeline and to report results back to the pipeline. Which integration approach should they use?

   • ARun DAST manually before each release.
   • BAdd a DAST tool as a pipeline stage that runs after deployment and publishes results.
   • CRun DAST only in production.
   • DUse SAST on the deployed application.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A security team wants to report to management on the effectiveness of their DevSecOps pipeline. They have data on the number of vulnerabilities found by SAST, DAST, and SCA over the last six months, as well as the time taken to remediate them. Management wants to see whether the pipeline is improving security. Which metric should they focus on?

   • AThe number of security tools used in the pipeline.
   • BThe total number of vulnerabilities found each month.
   • CThe percentage of builds that pass the security gates.
   • DThe mean time to remediate (MTTR) for critical and high vulnerabilities, tracked over time.
   Reveal Solution Discussion Select an answer first