Continuous Testing Tools DSE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the benefit of integrating continuous testing tools with build and deployment systems?

   • AIt eliminates the need for any manual oversight
   • BIt guarantees that no vulnerabilities are ever deployed
   • CIt speeds up the compilation of the code
   • DIt allows tests to run automatically as part of the build and deployment process
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A team wants to automatically block a build if any open-source dependency has a critical known vulnerability or a license that is incompatible with their commercial product. They use Maven for their Java project. What should they integrate into their CI pipeline?

   • AA code coverage tool that measures how much of the code is tested.
   • BA SAST tool that scans the Java source code for security flaws.
   • CAn SCA tool that scans the Maven dependency tree and fails the build on critical vulnerabilities or incompatible licenses.
   • DA DAST tool that scans the deployed application for runtime vulnerabilities.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security team wants to test a web application for vulnerabilities that only appear when the application is running with real user interactions, such as broken access control and business logic flaws. They want the test to be automated and run against the staging environment. Which tool should they use?

   • AA unit testing framework that runs tests in the CI pipeline.
   • BA SAST tool that scans the source code for access control patterns.
   • CAn SCA tool that checks for known vulnerabilities in third-party libraries.
   • DA DAST tool that crawls the application and sends crafted requests to test for access control and logic flaws.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   How does a Static Application Security Testing (SAST) tool analyze code?

   • ABy scanning the network for open ports and services
   • BBy inspecting the source code, bytecode, or binary without executing it
   • CBy executing the application and sending malicious payloads to it
   • DBy monitoring the application in production to detect real attacks
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company wants to implement continuous testing in their DevSecOps pipeline but is concerned about the impact on build time. They have a large codebase and running all tests on every commit would significantly slow down the pipeline. They want to balance thorough testing with fast feedback. Which approach is most effective?

   • ARun a fast subset of tests (unit tests and SAST) on every commit, and run the full suite (including DAST and integration tests) on merge requests or nightly builds.
   • BSkip all automated testing and rely on manual testing before each release.
   • CRun all tests on every commit, accepting the longer build time.
   • DRun the full test suite only on the main branch after every merge.
   Reveal Solution Discussion Select an answer first