Continuous Testing Tools DSE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the role of automated tests within a CI/CD pipeline?

   • ATo ensure that no security vulnerabilities ever reach production
   • BTo provide fast feedback on the quality and security of code changes
   • CTo replace the need for any form of manual testing
   • DTo automatically fix any defects found in the code
   Reveal Solution Discussion Select an answer first
2. 17application · easy

   A company currently performs security testing only after the application is fully built and deployed to a test environment. They want to reduce the cost and effort of fixing vulnerabilities by identifying them earlier in the development lifecycle. Which strategy should they adopt?

   • AShift-left testing by integrating SAST and unit tests into the developer's local environment and the CI pipeline.
   • BPerform manual penetration testing once before production release.
   • CIncrease the frequency of DAST scans in the test environment after deployment.
   • DMove all testing to a dedicated QA team that runs tests after each release.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which type of testing is best suited for identifying vulnerabilities that only appear when the application is running?

   • AManual code review
   • BSoftware Composition Analysis (SCA)
   • CStatic Application Security Testing (SAST)
   • DDynamic Application Security Testing (DAST)
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A team deploys a web application to a staging environment that is not accessible from the public internet. They want to run DAST scans automatically as part of the CI/CD pipeline. What must they configure to enable this?

   • ARun the DAST scan against the source code in the repository.
   • BExpose the staging application to the public internet so the scanner can reach it.
   • CEnsure the DAST scanner can reach the staging application over the internal network, such as by running the scanner inside the same network or using a VPN.
   • DUse a SAST tool instead because it does not require network access.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A team has a CI pipeline that runs SAST and SCA scans. The scans produce a large number of findings, and developers are ignoring the reports because they are too long and not prioritized. The team wants to improve the feedback loop so that developers focus on the most important issues first. What should they do?

   • AConfigure the tools to deduplicate findings, prioritize by severity and exploitability, and send a concise summary to the developer with links to the full report.
   • BDisable all findings except those that are in the OWASP Top 10.
   • COnly report the total number of findings without any details.
   • DSend the full raw report to every developer on the team after every build.
   Reveal Solution Discussion Select an answer first