Continuous Testing Tools DSE Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What does test coverage measure in the context of continuous testing?

   • AThe number of security vulnerabilities found
   • BThe time it takes to run the tests
   • CThe percentage of code that is executed by the test suite
   • DThe number of tests that have failed
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A company uses many open-source libraries in their Node.js application. They want to automatically detect known vulnerabilities in these libraries and also check for license compliance before each release. Which tool should they integrate into their pipeline?

   • AA container image scanner that only checks the base operating system packages.
   • BA dynamic application security testing (DAST) tool that scans the running application.
   • CA static application security testing (SAST) tool that scans the application's custom source code.
   • DA software composition analysis (SCA) tool that scans the dependency manifest and lock files.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the primary characteristic of Dynamic Application Security Testing (DAST)?

   • AIt tests the running application from an external perspective
   • BIt combines static and dynamic analysis in real-time
   • CIt analyzes source code without executing it
   • DIt scans dependencies for known vulnerabilities
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A team wants to enforce a minimum code coverage of 80% and no critical security vulnerabilities in their CI pipeline. However, they are concerned that a strict quality gate might block urgent hotfixes that need to go out quickly. They want to balance security with delivery speed. What is the best approach?

   • ASet the coverage gate to 100% and fail the build on any coverage shortfall, regardless of the reason.
   • BOnly run the quality gates on the main branch after the hotfix is already deployed.
   • CImplement quality gates that fail the build on critical vulnerabilities but only warn on coverage below 80%, allowing the team to override with a documented exception.
   • DRemove the quality gates entirely and rely on developers to run tests locally.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A team uses GitHub for version control, Jenkins for CI, and Artifactory for storing build artifacts. They want security scans to run automatically whenever a developer pushes code. Which integration approach is most effective?

   • AHave developers manually run SAST and SCA tools on their local machines before pushing code.
   • BRun SAST and SCA scans only in Artifactory after the build artifact is uploaded.
   • CSchedule nightly Jenkins jobs that scan the latest code and email results to the security team.
   • DConfigure a Jenkins pipeline that triggers on GitHub webhooks, runs SAST and SCA, and publishes results back to the pull request.
   Reveal Solution Discussion Select an answer first