A team is adopting shift-left testing but is concerned about slowing down the CI pipeline. They currently run a full SAST scan, unit tests, and integration tests on every commit. The pipeline takes 45 minutes, and developers are complaining about long feedback cycles. They want to maintain security coverage while improving developer velocity. Which strategy is most effective?

Run the full pipeline on every commit and ask developers to wait for the results.

Increase the pipeline timeout to 60 minutes so the full suite can complete.

Remove SAST from the pipeline and rely only on DAST in staging.

Run fast unit tests and a targeted SAST scan on every commit, and run the full SAST and integration tests on pull requests or nightly builds.

After integrating SAST into the CI pipeline, developers complain that they receive too many alerts and do not know which ones to fix first. The security team wants to improve the feedback loop so developers can prioritize remediation. Which approach is most effective?

Store all SAST results in a database and require developers to query it manually.

Disable the SAST tool to avoid overwhelming developers.

Configure the SAST tool to report only new high-severity issues in the pull request and provide links to the exact code location.

Send a daily email with all SAST findings to the entire development team.

A security team wants to test a web application for vulnerabilities such as SQL injection and cross-site scripting from an external attacker's perspective. The application is deployed in a staging environment. Which testing approach should they use?

Use an SCA tool to scan the application's dependencies for known vulnerabilities.

Run a DAST tool against the staging environment's URL to simulate external attacks.

Run a SAST tool on the application's source code to look for injection flaws.

Perform a manual code review of the application's authentication logic.

EC-CouncilDevSecOps Essentials

Domain 3Objective 3

Continuous Testing Tools DSE Practice Questions (Page 12)

Part of the DevSecOps Toolchain domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 2–3 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

10concepts

10 Concepts in This Objective

Continuous testing fundamentals
Test automation in CI/CD
Static application security testing (SAST)
Dynamic application security testing (DAST)
Software composition analysis (SCA)
Interactive application security testing (IAST)
Test coverage and quality gates
Shift-left testing strategy
Continuous testing tool integration
Reporting and feedback loops

Questions 56–58

56expert · hard
A team is adopting shift-left testing but is concerned about slowing down the CI pipeline. They currently run a full SAST scan, unit tests, and integration tests on every commit. The pipeline takes 45 minutes, and developers are complaining about long feedback cycles. They want to maintain security coverage while improving developer velocity. Which strategy is most effective?
Select an answer first
57application · medium
After integrating SAST into the CI pipeline, developers complain that they receive too many alerts and do not know which ones to fix first. The security team wants to improve the feedback loop so developers can prioritize remediation. Which approach is most effective?
Select an answer first
58application · medium
A security team wants to test a web application for vulnerabilities such as SQL injection and cross-site scripting from an external attacker's perspective. The application is deployed in a staging environment. Which testing approach should they use?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.

Continuous Testing Tools DSE Practice Questions (Page 12)

Questions 56–58

After integrating SAST into the CI pipeline, developers complain that they receive too many alerts and do not know which ones to fix first. The security team wants to improve the feedback loop so developers can prioritize remediation. Which approach is most effective?

A security team wants to test a web application for vulnerabilities such as SQL injection and cross-site scripting from an external attacker's perspective. The application is deployed in a staging environment. Which testing approach should they use?

Keep studying — DevSecOps Toolchain