Continuous Testing Tools DSE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A developer wants to catch security vulnerabilities in their code before pushing to the shared repository. They are working in an IDE and want immediate feedback on potential issues in the code they are writing. Which approach is most aligned with shift-left testing?

   • ARun a DAST scan against the deployed application after the code is committed.
   • BWait for the CI pipeline to run SAST after the push and review the results in the build log.
   • CAsk a security expert to review the code manually before each commit.
   • DUse a SAST plugin in the IDE that analyzes the code as it is written and highlights issues inline.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which practice is an example of shift-left testing?

   • AConducting a full penetration test only after the release
   • BRunning security tests in production after deployment
   • CPerforming code analysis and unit tests during the development phase
   • DWaiting until user acceptance testing to involve stakeholders
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A team uses Jenkins for CI/CD and wants security testing tools to automatically run on every code commit and have the results posted back to the developer who made the commit. What is the best way to achieve this?

   • ASchedule security tests to run once a week and email the entire team the results.
   • BHave developers manually run security tests locally and paste results into the Jenkins build log.
   • CUse a standalone security scanner that is not integrated with Jenkins and review results in its own dashboard.
   • DConfigure Jenkins to trigger security test jobs on commit hooks and use plugins to publish results to the commit author.
   Reveal Solution Discussion Select an answer first
5. 39application · easy

   An organization uses many open-source libraries in its applications. The security team wants to automatically block builds that include components with known critical vulnerabilities and also flag components with restrictive licenses. Which tool should be integrated into the CI pipeline?

   • AInteractive Application Security Testing (IAST)
   • BSoftware Composition Analysis (SCA)
   • CDynamic Application Security Testing (DAST)
   • DStatic Application Security Testing (SAST)
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company wants to reduce the time between a code change and the discovery of a security vulnerability, and also reduce the cost of fixing it. They plan to run automated security tests as part of the CI pipeline on every commit. What is the primary benefit of this approach?

   • AIt identifies vulnerabilities early in the development lifecycle, making them less expensive to fix.
   • BIt guarantees that no vulnerabilities will reach production.
   • CIt reduces the need for developers to write secure code.
   • DIt eliminates the need for any manual security testing.
   Reveal Solution Discussion Select an answer first