A team deploys a web application that requires authentication. They want to run DAST scans in the CI/CD pipeline. The DAST tool needs to access authenticated pages to be effective. What should they configure?

Use a SAST tool instead, since it can analyze the authentication logic without needing credentials.

Run the DAST scan only on the login page, since that is the only page that requires authentication.

Provide the DAST tool with test credentials and configure the authentication flow in the scan settings.

Disable authentication in the test environment so the DAST tool can access all pages.

What is the purpose of correlating findings from SAST and DAST scans?

To identify vulnerabilities that are only detectable by one type of scan

To reduce false positives by confirming vulnerabilities with multiple data points

To increase the total number of reported vulnerabilities

To replace the need for manual security review

In a CI/CD pipeline, when is Dynamic Application Security Testing (DAST) typically executed?

During the post-production monitoring stage, after the application is live

During the source code commit stage, before any build occurs

During the build stage, before the application is compiled

During the test stage, after the application is deployed to a test environment

A team uses an IAST tool in their CI/CD pipeline. They notice that the IAST tool only reports vulnerabilities when certain test cases are executed. They want to improve coverage. What should they do?

Run the IAST scan in production to capture real user traffic.

Expand the automated test suite to cover more code paths and edge cases.

Switch to a DAST tool that does not require test cases.

Increase the IAST agent's sampling rate to capture more data.

A DevSecOps team is automating security scans in a GitLab CI/CD pipeline. They have a requirement that the pipeline should not be blocked by security scan failures during off-peak hours, but should be blocked during business hours. They also want to ensure that all findings are tracked in an issue tracker. What is the best way to implement this?

Never fail the build on security findings, and only create issues for critical findings.

Always fail the build on any security finding, regardless of time.

Use a pipeline rule that fails the build only during business hours, and automatically create issues for all findings at all times.

Fail the build only on DAST findings, and ignore SAST findings during off-peak hours.

EC-CouncilDevSecOps Essentials

Domain 5Objective 3

Integrating SAST, DAST, and IAST in Build and Test DSE Practice Questions (Page 1)

Part of the Implementing DevSecOps Testing and Threat Modeling domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

7concepts

Questions 1–5

1application · medium
A team deploys a web application that requires authentication. They want to run DAST scans in the CI/CD pipeline. The DAST tool needs to access authenticated pages to be effective. What should they configure?
Select an answer first
2foundation · easy
What is the purpose of correlating findings from SAST and DAST scans?
Select an answer first
3foundation · easy
In a CI/CD pipeline, when is Dynamic Application Security Testing (DAST) typically executed?
Select an answer first
4application · medium
A team uses an IAST tool in their CI/CD pipeline. They notice that the IAST tool only reports vulnerabilities when certain test cases are executed. They want to improve coverage. What should they do?
Select an answer first
5expert · hard
A DevSecOps team is automating security scans in a GitLab CI/CD pipeline. They have a requirement that the pipeline should not be blocked by security scan failures during off-peak hours, but should be blocked during business hours. They also want to ensure that all findings are tracked in an issue tracker. What is the best way to implement this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.