Continuous Testing Tools DSE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An organization wants to reduce the cost and effort of fixing security defects by identifying them as early as possible in the development lifecycle. Currently, security testing is performed only after the application is fully built and deployed. Which strategy should they adopt?

   • AOutsource all security testing to an external penetration testing firm on a quarterly basis.
   • BShift security testing left by integrating SAST and unit tests into the development and CI stages.
   • CContinue with post-deployment DAST scans and increase the frequency of those scans.
   • DPerform a single comprehensive security review just before the production release.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A team uses Azure DevOps for CI/CD. They want to run SAST and SCA scans on every pull request and block the pull request if any critical vulnerability is found. However, they also want to allow non-critical findings to be reviewed later without blocking the merge. What is the best way to configure this?

   • AConfigure the scans to fail on any finding, regardless of severity.
   • BRun the scans only after the pull request is merged and create work items for any findings.
   • CUse a manual approval step in the pipeline to review all findings before the merge.
   • DUse a branch policy that requires the SAST and SCA tasks to pass, and configure the tasks to fail only on critical severity findings.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A team is testing a Java web application and wants to detect vulnerabilities that only appear during execution, such as SQL injection through a specific code path, while also getting line-level code locations for the fix. Which testing approach provides this combination?

   • ADAST
   • BSAST
   • CSCA
   • DIAST
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which benefit is most directly associated with implementing continuous testing in a DevSecOps pipeline?

   • AGuaranteed elimination of all software defects
   • BReduced cost and effort of fixing defects by detecting them earlier
   • CElimination of the need for manual code reviews
   • DAutomatic resolution of security vulnerabilities without human intervention
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A team has a web application deployed in a staging environment that mirrors production. They want to automate security testing that exercises the running application from an external perspective, including authentication flows and API endpoints. Which tool category should they integrate into their CI/CD pipeline?

   • ASCA
   • BDAST
   • CIAST
   • DSAST
   Reveal Solution Discussion Select an answer first