Integrating SAST, DAST, and IAST in Build and Test DSE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A team is evaluating IAST tools for a Java application that runs in a containerized environment. They have a requirement to detect vulnerabilities during automated integration tests without modifying the application source code. Which consideration is most important when selecting an IAST tool?

   • AThe tool must be able to scan the source code without executing the application.
   • BThe tool must support agent-based instrumentation that can be injected into the container at runtime.
   • CThe tool must be able to run as a standalone CLI without any runtime integration.
   • DThe tool must be able to crawl the application like a DAST scanner.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A team builds a React single-page application (SPA) that calls a separate REST API. They want to integrate security testing into their CI/CD pipeline. Which tool combination is most appropriate?

   • AUse only SAST on the React code and skip DAST because the API is tested separately.
   • BUse only DAST on the deployed SPA, since client-side code is not security-sensitive.
   • CUse IAST on the React code and DAST on the API.
   • DUse SAST on the React code and DAST on the deployed SPA and API endpoints.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   When selecting a SAST tool for a CI/CD pipeline, which factor is most important to consider?

   • AThe tool's ability to run without any configuration
   • BThe tool's ability to test the application from the outside
   • CThe tool's ability to monitor production traffic
   • DThe tool's support for the programming languages used in the application
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security team receives a combined report from SAST and DAST scans. The SAST report shows 50 potential SQL injection issues in the source code, and the DAST report shows 3 confirmed SQL injection vulnerabilities in the running application. The team has limited development resources. How should they prioritize remediation?

   • APrioritize the 3 confirmed DAST findings first because they are verified exploitable in the running application, then address the SAST findings.
   • BPrioritize all 50 SAST findings first because they are found earlier in the pipeline.
   • CIgnore the DAST findings because SAST already found the same issues.
   • DRemediate all findings in the order they appear in the report, regardless of severity.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A development team is adopting a DevSecOps pipeline for a Java web application. They want to catch common coding flaws (e.g., SQL injection, XSS) as early as possible without slowing down the developer feedback loop. The team uses a Jenkins pipeline with separate build and test stages. Which integration approach best meets this requirement?

   • ARun a SAST scanner in the build stage after compilation, fail the build on critical findings, and publish the report to the developers.
   • BRun an IAST agent in the test stage and rely on its runtime analysis to catch all source-level vulnerabilities.
   • CRun a DAST scanner in the test stage against a staging instance, and only report findings without failing the build.
   • DRun SAST only on the main branch after merging, and manually review the results in a weekly meeting.
   Reveal Solution Discussion Select an answer first