Integrating SAST, DAST, and IAST in Build and Test DSE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company is selecting security testing tools for a new project. The application is a single-page application (SPA) with a REST API backend. The team wants to test both the client-side and server-side vulnerabilities. They have a limited budget and need to choose between a commercial SAST tool and a commercial DAST tool. Which approach is most effective?

   • AUse only a commercial SAST tool because it can analyze both client and server code.
   • BUse only a commercial DAST tool because it can test the running application end-to-end.
   • CUse a commercial DAST tool for the SPA and an open-source SAST tool for the backend.
   • DUse a commercial SAST tool for the backend code and an open-source DAST tool that can crawl the SPA and test the API.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A team is using IAST in their CI/CD pipeline. They notice that IAST is reporting many vulnerabilities that are not reproducible in manual testing. The team suspects that the IAST agent is generating false positives due to the way it instruments the application. What is the most appropriate action?

   • ARun IAST in production to get more accurate results.
   • BDisable IAST and rely on SAST and DAST only.
   • CReview the IAST agent's configuration and adjust the sensitivity settings, and correlate findings with the specific test cases that triggered them.
   • DIgnore the IAST findings because they are likely false positives.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A team wants to run DAST scans in their CI/CD pipeline for a web application that uses a third-party single sign-on (SSO) provider. The DAST tool needs to authenticate to test authenticated pages. The team is concerned about storing credentials in the pipeline configuration. What is the best approach?

   • AUse the production admin account for the DAST scan to ensure full coverage.
   • BAsk the SSO provider to disable authentication for the test environment.
   • CUse a dedicated test account with limited permissions and store the credentials in the CI/CD system's secret management feature.
   • DHardcode the credentials in the DAST configuration file in the repository.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A team is integrating SAST into their Jenkins pipeline. They are concerned about slowing down the build and causing developer frustration. They want to minimize disruption while still catching critical vulnerabilities. Which best practice should they apply?

   • ARun SAST with all rules enabled and fail the build on any finding, including informational.
   • BRun SAST manually on a weekly basis to avoid pipeline overhead.
   • CRun SAST as a separate pipeline stage that does not block the build for low-severity findings, but fails the build on critical and high-severity vulnerabilities.
   • DRun SAST only on the main branch after merge to avoid slowing down feature branches.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A DevOps team wants to automate SAST and DAST scans in their GitLab CI/CD pipeline. They need to ensure that scan results are centrally visible to developers and security teams. Which approach best achieves this?

   • AUse a third-party tool that writes results to a JSON file and require developers to download it manually.
   • BRun SAST and DAST as separate external jobs and email the raw output to the security team.
   • CUse GitLab's built-in SAST and DAST analyzers and publish the reports as pipeline artifacts.
   • DRun SAST and DAST only on a schedule and store results in a shared network folder.
   Reveal Solution Discussion Select an answer first