SAST and DAST Testing DSE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A DevOps team wants to integrate SAST into their CI/CD pipeline. They use a Jenkins pipeline that builds the application and runs unit tests. The team wants to fail the build when critical vulnerabilities are found, but they also want to avoid blocking developers on low-severity issues. Which approach best achieves this goal?

   • ARun SAST only on release branches and ignore findings in feature branches.
   • BRun SAST after deployment to production and manually review all findings.
   • CRun SAST after the build step, fail the pipeline on critical and high findings, and report medium/low findings as warnings.
   • DRun SAST on the final build artifact and fail the pipeline on any finding regardless of severity.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is a key requirement for conducting DAST on a web application?

   • AThe application must be built with a specific programming language.
   • BA running instance of the application that is accessible over a network.
   • CThe application must be deployed in a production environment.
   • DAccess to the application's source code repository.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In which phase of the software development lifecycle (SDLC) is SAST most effectively integrated to provide the greatest benefit?

   • ADuring the requirements gathering phase, before any code is written.
   • BAfter the application is deployed to production, as a final security check.
   • CDuring the retirement phase, to document vulnerabilities for historical purposes.
   • DDuring the coding and build phase, before the application is deployed.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security lead is designing a testing strategy for a new web application. The team wants to ensure that vulnerabilities are detected as early as possible, but also wants to validate that the application behaves securely in a runtime environment. The application is developed using an agile methodology with frequent releases. Which approach best satisfies both requirements?

   • ARun DAST on every developer's local machine before committing code.
   • BPerform only manual code reviews and penetration testing at the end of each sprint.
   • CRun SAST only in production after deployment.
   • DIntegrate SAST into the CI pipeline and schedule DAST runs against staging builds.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security team is deciding which testing method to use for a microservices-based application where each service is developed and deployed independently. They want to catch vulnerabilities before each service is deployed. Which approach is most appropriate?

   • ARun a single DAST scan against the entire microservices architecture.
   • BRun DAST on each service after deployment to the production environment.
   • CRun SAST only on the main service and rely on it for all services.
   • DRun SAST on each service's codebase in its CI pipeline before deployment.
   Reveal Solution Discussion Select an answer first