Which practice is a best practice for integrating security testing tools into a CI/CD pipeline to minimize disruption?

Running security scans manually on a monthly basis

Running security scans in parallel with other pipeline stages to reduce overall build time

Running all security scans on every commit without any thresholds

Running security scans only after the application is deployed to production

What is a recommended best practice for handling scan results in a CI/CD pipeline to maximize coverage while minimizing disruption?

Ignoring low-severity vulnerabilities to avoid slowing down the pipeline

Using a severity-based threshold to fail the build only for critical or high-severity vulnerabilities

Failing the build on any vulnerability, regardless of severity

Running security scans only on release branches, not on feature branches

A team wants to integrate SAST, DAST, and IAST into their CI/CD pipeline. They have a limited number of build agents and want to minimize the impact on pipeline duration. They also need to ensure that results are correlated for effective remediation. Which orchestration approach is best?

Run SAST, DAST, and IAST sequentially in the same stage to simplify the pipeline.

Run all three tools in separate pipelines and manually combine the results.

Run SAST and IAST in parallel during the build/test phase, and run DAST after deployment, then merge all results into a single report.

Run SAST only, and skip DAST and IAST to save time.

In a CI/CD pipeline, at which stage is Static Application Security Testing (SAST) most commonly integrated to identify vulnerabilities in source code early?

During the test stage, after the application is deployed to a staging environment

During the deployment stage, after the application is running in production

During the build stage, after code compilation but before packaging

During the monitoring stage, after the application is released to users

What is the primary purpose of integrating a SAST tool into the CI/CD build pipeline?

To perform penetration testing on the deployed application

To analyze source code for security vulnerabilities before the application is deployed

To monitor production traffic for security incidents

To test the application's runtime behavior for vulnerabilities

EC-CouncilDevSecOps Essentials

Domain 5Objective 3

Integrating SAST, DAST, and IAST in Build and Test DSE Practice Questions (Page 7)

Part of the Implementing DevSecOps Testing and Threat Modeling domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

7concepts

Questions 31–35

31foundation · easy
Which practice is a best practice for integrating security testing tools into a CI/CD pipeline to minimize disruption?
Select an answer first
32foundation · easy
What is a recommended best practice for handling scan results in a CI/CD pipeline to maximize coverage while minimizing disruption?
Select an answer first
33expert · hard
A team wants to integrate SAST, DAST, and IAST into their CI/CD pipeline. They have a limited number of build agents and want to minimize the impact on pipeline duration. They also need to ensure that results are correlated for effective remediation. Which orchestration approach is best?
Select an answer first
34foundation · easy
In a CI/CD pipeline, at which stage is Static Application Security Testing (SAST) most commonly integrated to identify vulnerabilities in source code early?
Select an answer first
35foundation · easy
What is the primary purpose of integrating a SAST tool into the CI/CD build pipeline?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.