A security analyst is reviewing a scan report that contains a SAST finding for a potential command injection in a web application. The DAST scan did not find this vulnerability. What should the analyst do?

Ignore the finding because SAST is known to have a high false-positive rate.

Close the finding because DAST did not confirm it.

Automatically deploy the fix to production without further analysis.

Manually verify the SAST finding by reviewing the code and attempting to exploit it in a test environment.

EC-CouncilDevSecOps Essentials

Domain 5Objective 3

Integrating SAST, DAST, and IAST in Build and Test DSE Practice Questions (Page 9)

Part of the Implementing DevSecOps Testing and Threat Modeling domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

7concepts

Questions 41–41

41application · medium
A security analyst is reviewing a scan report that contains a SAST finding for a potential command injection in a web application. The DAST scan did not find this vulnerability. What should the analyst do?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.

Integrating SAST, DAST, and IAST in Build and Test DSE Practice Questions (Page 9)

Questions 41–41

A security analyst is reviewing a scan report that contains a SAST finding for a potential command injection in a web application. The DAST scan did not find this vulnerability. What should the analyst do?

Keep studying — Implementing DevSecOps Testing and Threat Modeling