A team receives scan results from SAST, DAST, and IAST tools in their CI/CD pipeline. They want to prioritize remediation efforts effectively. Which practices should they follow? Select all that apply.

Prioritize based on the CVSS score alone, without considering the application context.

Treat all findings equally and fix them in the order they were reported.

Correlate findings across tools to identify vulnerabilities that are confirmed by multiple sources.

Use a risk-based scoring model that combines severity, exploitability, and business impact.

Focus on vulnerabilities that are reachable by an attacker and have a clear exploit path.

A team is introducing SAST into a fast-moving CI/CD pipeline. Developers are concerned that scans will slow down builds and delay releases. Which practice best minimizes disruption while maintaining security coverage?

Run SAST after the release to avoid any delay in the pipeline.

Run SAST in parallel with the build and test stages, and only fail the build on new critical findings.

Run SAST with a very broad ruleset to catch as many issues as possible, even if it takes longer.

Run SAST only on the main branch and not on feature branches.

A team is developing a .NET web application with extensive unit and integration tests. They want to identify vulnerabilities that only appear during runtime, such as insecure deserialization and access control issues, while the tests are running. Which tool type and integration point is most appropriate?

Instrument the application with an IAST agent and run it during the existing automated test suite in the test stage.

Run a DAST scanner against the application after the test suite completes.

Run a manual penetration test after the release to catch runtime issues.

Run a SAST scanner on the compiled binaries after the build stage.

What is the key characteristic of Interactive Application Security Testing (IAST) that distinguishes it from SAST and DAST?

It only scans for vulnerabilities in third-party dependencies

It tests the application from the outside without any internal visibility

It analyzes source code without executing the application

It combines static and dynamic analysis by instrumenting the application and observing its behavior in real time

EC-CouncilDevSecOps Essentials

Domain 5Objective 3

Integrating SAST, DAST, and IAST in Build and Test DSE Practice Questions (Page 6)

Part of the Implementing DevSecOps Testing and Threat Modeling domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

7concepts

Questions 26–30

26expert · hard · select all that apply
A team receives scan results from SAST, DAST, and IAST tools in their CI/CD pipeline. They want to prioritize remediation efforts effectively. Which practices should they follow? Select all that apply.
Select an answer first
27application · medium
A team is introducing SAST into a fast-moving CI/CD pipeline. Developers are concerned that scans will slow down builds and delay releases. Which practice best minimizes disruption while maintaining security coverage?
Select an answer first
28foundation · easy
For a web application that is already deployed in a staging environment, which type of security testing tool is most appropriate to select?
Select an answer first
29application · medium
A team is developing a .NET web application with extensive unit and integration tests. They want to identify vulnerabilities that only appear during runtime, such as insecure deserialization and access control issues, while the tests are running. Which tool type and integration point is most appropriate?
Select an answer first
30foundation · easy
What is the key characteristic of Interactive Application Security Testing (IAST) that distinguishes it from SAST and DAST?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.

Integrating SAST, DAST, and IAST in Build and Test DSE Practice Questions (Page 6)

Questions 26–30

A team receives scan results from SAST, DAST, and IAST tools in their CI/CD pipeline. They want to prioritize remediation efforts effectively. Which practices should they follow? Select all that apply.

A team is introducing SAST into a fast-moving CI/CD pipeline. Developers are concerned that scans will slow down builds and delay releases. Which practice best minimizes disruption while maintaining security coverage?

For a web application that is already deployed in a staging environment, which type of security testing tool is most appropriate to select?

What is the key characteristic of Interactive Application Security Testing (IAST) that distinguishes it from SAST and DAST?

Keep studying — Implementing DevSecOps Testing and Threat Modeling