Integrating SAST, DAST, and IAST in Build and Test DSE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What type of vulnerabilities is DAST specifically designed to detect?

   • AVulnerabilities that appear only when the application is running, such as misconfigurations and authentication flaws
   • BVulnerabilities in third-party libraries used by the application
   • CVulnerabilities in the application's build configuration files
   • DVulnerabilities in source code, such as hardcoded credentials and insecure coding patterns
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary benefit of automating SAST, DAST, and IAST scans within a CI/CD pipeline?

   • AIt ensures security testing is performed consistently and repeatedly on every code change
   • BIt replaces the need for code review by developers
   • CIt eliminates the need for manual security testing entirely
   • DIt guarantees that all vulnerabilities are found before release
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the purpose of orchestrating the results from multiple security testing tools in a CI/CD pipeline?

   • ATo increase the number of false positives
   • BTo combine findings into a single, unified report for easier analysis and prioritization
   • CTo replace the need for a vulnerability management system
   • DTo automatically fix all identified vulnerabilities
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A DevOps team wants to automate security testing in their GitLab CI/CD pipeline. They have a microservices architecture with multiple services. They want to run SAST on every commit and DAST on the deployed staging environment nightly. What is the best way to orchestrate these scans?

   • ARun both SAST and DAST in the same job on every commit to save pipeline time.
   • BCreate separate pipeline jobs: one for SAST triggered on every commit, and one for DAST triggered on a schedule or after deployment.
   • CRun SAST and DAST only in a nightly job to minimize resource usage.
   • DRun DAST on every commit and SAST only on the main branch.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A team is developing a financial application with strict compliance requirements. They have a large existing test suite that covers many business logic paths. They want to integrate IAST to detect vulnerabilities that require specific user roles and data conditions. However, the test suite runs in parallel to reduce execution time. What is the most important consideration when configuring IAST in this environment?

   • AEnsure the IAST agent is configured to correlate findings with the specific test case and user context that triggered them.
   • BDisable IAST for tests that involve sensitive data to avoid compliance issues.
   • CRun the test suite serially to ensure IAST captures all vulnerabilities accurately.
   • DUse IAST only on the main branch after merge to reduce noise.
   Reveal Solution Discussion Select an answer first