Integrating SAST, DAST, and IAST in Build and Test DSE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A team wants to automate DAST scans in their Jenkins pipeline. They have multiple application environments (dev, test, staging). They want to run DAST scans automatically after each deployment to staging. What is the best way to configure this?

   • ARun DAST scans only in production after each release.
   • BRun DAST scans manually from a developer's workstation when needed.
   • CSchedule DAST scans to run every night against all environments.
   • DAdd a post-deployment stage in the pipeline that triggers the DAST scan against the staging URL and publishes the report.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company has a legacy monolithic application written in PHP and a new microservices-based application written in Go. They want to implement security testing in their CI/CD pipeline. The team has budget constraints and wants to maximize coverage. Which tooling strategy is most appropriate?

   • AUse SAST for both applications, and add DAST for the monolithic application only.
   • BUse IAST for both applications, since it combines static and dynamic analysis.
   • CUse a single commercial tool that supports all three types (SAST, DAST, IAST) for both applications.
   • DUse DAST for both applications and skip SAST entirely.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A DevSecOps team is using Azure DevOps. They want to automate SAST, DAST, and IAST scans and consolidate the results into a single dashboard for developers. What is the best way to orchestrate this?

   • ARun all three scans in a single script and output the results to the console.
   • BUse separate pipeline tasks for each scan type, publish results in a common format, and use a reporting tool to aggregate the findings.
   • CRun only SAST and DAST, and skip IAST because it is redundant.
   • DRun the scans manually and email the reports to the security team.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A team uses both SAST and IAST in their pipeline. SAST reports a potential SQL injection in a function, but IAST does not flag it during tests. What should the team do?

   • AInvestigate whether the IAST test cases actually exercise the vulnerable code path.
   • BAssume the SAST finding is a false positive and close it.
   • CIgnore the SAST finding because IAST is more accurate.
   • DDisable the SAST rule for SQL injection to reduce false positives.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security team is triaging a large number of findings from SAST and DAST. They notice that many SAST findings are in code that is not reachable from any user input, and many DAST findings are in legacy endpoints that are being deprecated. The team has limited remediation resources. What is the most effective triage strategy?

   • AIgnore all findings in deprecated code and only fix new code.
   • BPrioritize DAST findings in active endpoints, then SAST findings that are reachable and exploitable, and deprioritize findings in deprecated code.
   • CRemediate all DAST findings first because they are confirmed exploitable.
   • DRemediate all SAST findings first because they are found earlier in the pipeline.
   Reveal Solution Discussion Select an answer first