Integrating SAST, DAST, and IAST in Build and Test DSE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A large organization has multiple development teams using different CI/CD platforms (Jenkins, GitLab CI, and Azure DevOps). They want to standardize SAST integration across all pipelines without forcing teams to change their CI/CD platform. Which approach best achieves this?

   • ARun SAST scans only in a nightly batch job on a central server, outside of the CI/CD pipelines.
   • BRequire all teams to migrate to a single CI/CD platform to use the same SAST plugin.
   • CUse a centralized SAST orchestration service that exposes a REST API and have each pipeline call it with the source code.
   • DHave each team configure their own SAST tool independently and share results via email.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   After integrating SAST into their pipeline, a team receives a large number of findings. Many are false positives, but some are real critical vulnerabilities. The team wants to reduce noise and focus on genuine issues. What should they do first?

   • ADisable the SAST tool because it generates too many false positives.
   • BConfigure the SAST tool to suppress known false positives and set a severity threshold to fail the build only on critical or high findings.
   • CIncrease the SAST scan frequency to get more data points.
   • DManually review every finding and fix all of them, including false positives.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   In a CI/CD pipeline, where is an IAST agent typically installed to provide real-time vulnerability detection?

   • AOn the build server, to scan the source code repository
   • BOn the application server, alongside the running application
   • COn the network perimeter, to inspect incoming traffic
   • DOn the developer's workstation, to analyze code during development
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A team is integrating security testing into a Jenkins pipeline for a web application. They want to ensure that security scans do not cause unnecessary pipeline failures due to infrastructure issues. What is the best practice?

   • ARun security scans only on a nightly basis to avoid pipeline failures during the day.
   • BDisable security scans if they cause any pipeline delay.
   • CFail the pipeline on any scanner error, including timeouts, to ensure security is always enforced.
   • DConfigure the pipeline to treat scanner infrastructure failures as unstable rather than failed, while still failing on actual security findings.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A security team receives SAST and DAST reports from the CI/CD pipeline. SAST flags a potential command injection in a legacy module, but DAST does not find it in the deployed application. The team has limited resources and must decide how to prioritize. What should they do?

   • AClose the SAST finding because DAST did not confirm it.
   • BImmediately deploy a fix to production without further analysis.
   • CTreat the SAST finding as a potential vulnerability and manually verify whether the code path is reachable and exploitable.
   • DIgnore the SAST finding and rely on DAST for all future security decisions.
   Reveal Solution Discussion Select an answer first