SAST and DAST Testing DSE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team is evaluating a vulnerability reported by a developer. The developer says the issue was found by a tool that scans the source code for insecure patterns. The team wants to know if this vulnerability could be exploited in the running application. What should they do?

   • ARun a DAST scan against the application to see if the vulnerability is exploitable.
   • BIgnore the finding because SAST is not reliable.
   • CRun another SAST scan with a different tool to confirm the finding.
   • DTrust the SAST finding and fix it immediately without further testing.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A development team is using a SAST tool that reports a high number of false positives. The team is frustrated and wants to reduce the noise. What is the best way to handle this?

   • AIncrease the severity threshold to critical so that fewer findings are reported.
   • BAsk developers to manually review every finding and decide which to ignore.
   • CTune the SAST tool's rules and baseline known false positives so that only relevant findings are reported.
   • DDisable the SAST tool entirely because it is not effective.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company is developing a highly regulated application that must undergo a security review before each release. The release cycle is very short, and the team needs to balance thorough testing with speed. They have both SAST and DAST tools available. What is the most effective way to use them?

   • ARun SAST on every commit and skip DAST because SAST is sufficient.
   • BRun SAST and DAST only before each release.
   • CRun DAST on every commit and SAST only before release.
   • DRun SAST in the CI pipeline on every commit and run DAST on the staging environment before each release.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A development team is integrating SAST into their CI pipeline. The SAST tool is producing a high number of false positives, and developers are becoming desensitized to the alerts. The team wants to maintain security coverage while improving developer trust in the tool. Which approach is most effective?

   • AIncrease the severity threshold to only report critical vulnerabilities.
   • BDisable the SAST tool and rely on manual code reviews.
   • CEstablish a baseline of known false positives, suppress them, and review new findings in a dedicated security review meeting.
   • DRun SAST only on release branches to reduce the number of alerts.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security tester is planning a DAST scan of a web application that uses a login form. The tester wants to test authenticated areas of the application. What is the best way to handle authentication in the DAST scan?

   • AAsk the development team to disable authentication for the scan.
   • BRun the scan without authentication to avoid being locked out.
   • CUse a brute-force attack to guess credentials during the scan.
   • DConfigure the DAST tool with valid credentials and ensure the session is maintained during the scan.
   Reveal Solution Discussion Select an answer first