Continuous Testing Tools DSE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   How does Interactive Application Security Testing (IAST) differ from SAST and DAST?

   • AIAST combines static and dynamic analysis in real-time during application execution
   • BIAST only tests the application's user interface
   • CIAST scans the application's dependencies for known vulnerabilities
   • DIAST only runs in production environments
   Reveal Solution Discussion Select an answer first
2. 32application · easy

   An organization is adopting DevSecOps and wants to ensure that security testing is not a separate phase at the end of development but is integrated throughout the pipeline. Which approach best achieves this?

   • ASchedule a security testing phase after each release in the change management process.
   • BRun security tests only when a major feature is added to the application.
   • CAssign a security team to manually test the application before each production deployment.
   • DEmbed automated security tests into the CI/CD pipeline so they run on every code change alongside functional tests.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A development team wants to run unit tests and SAST scans automatically on every pull request before code is merged into the main branch. They use GitHub Actions and want to fail the merge if any test fails or a critical vulnerability is found. What is the most appropriate way to configure this?

   • ARun the tests and SAST scanner manually on a developer's local machine before pushing code to the repository.
   • BSet up a nightly cron job in GitHub Actions that runs the tests and SAST scanner and sends an email report to the team.
   • CAdd a GitHub Actions workflow that runs on pull_request events, executes the tests and SAST scanner, and uses a quality gate to fail the job on failure.
   • DConfigure a webhook that triggers the SAST scanner only after the pull request is merged into the main branch.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A team wants to enforce a minimum level of code coverage and ensure that no critical security vulnerabilities are present before a build can be promoted to production. They have a CI pipeline. What should they configure?

   • AIncrease the number of unit tests without setting any thresholds or gates.
   • BSet up quality gates in the CI pipeline that check coverage thresholds and security scan results, failing the build if they are not met.
   • CRun the security scans only in a separate nightly job and review the results manually each morning.
   • DUse a coverage tool to generate reports and email them to the team after deployment.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A team is experiencing a high rate of false positives from their SAST tool, which is slowing down development. They want to reduce false positives while still detecting vulnerabilities that are actually exploitable in the context of their application. They have a comprehensive suite of automated functional tests that exercise the application. Which approach is most effective?

   • AKeep the SAST tool but disable all findings that are not in the OWASP Top 10.
   • BRun the SAST tool only once a month and manually triage all findings.
   • CReplace the SAST tool with an IAST tool that instruments the application and runs during the functional tests.
   • DUse a DAST tool instead, but only scan the application after all functional tests are complete.
   Reveal Solution Discussion Select an answer first