SAST and DAST Testing DSE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security team is planning to implement both SAST and DAST in their organization. They have limited budget and want to maximize the value of their security testing. The team has a mix of new and legacy applications. Which strategy is most cost-effective and comprehensive?

   • AOutsource all security testing to a third-party penetration testing firm.
   • BPrioritize SAST for new applications in development and DAST for legacy applications that are already running.
   • CUse only DAST for all applications, since it tests the running application.
   • DUse only SAST for all applications, regardless of their lifecycle stage.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A development team is adopting a security testing strategy. They want to catch vulnerabilities as early as possible in the CI pipeline, before the application is deployed. However, they also need to identify runtime issues such as authentication bypasses that only appear when the application is fully running. Which combination of testing approaches should they implement?

   • ARun only DAST in the staging environment and skip static analysis.
   • BRun only SAST in the CI pipeline and rely on code reviews for runtime issues.
   • CRun SAST during the build phase and DAST against a staging environment after deployment.
   • DRun DAST during the build phase and SAST against the production environment.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A DevOps team is integrating SAST into their CI/CD pipeline. They have multiple applications with different programming languages and frameworks. The team wants to standardize the SAST process across all applications while allowing for language-specific rules. What is the best way to achieve this?

   • AUse a SAST tool that supports multiple languages and configure language-specific rule packs in the pipeline.
   • BUse a DAST tool instead, since it is language-agnostic.
   • CUse different SAST tools for each language and integrate them separately.
   • DUse a single SAST tool with default rules for all applications.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security team is planning to run DAST on a web application that has a complex workflow involving multiple steps and stateful sessions. The DAST tool they are using is not able to automatically navigate the workflow. What is the best way to ensure the DAST scan covers the entire application?

   • ARun the DAST scan only on the login page and hope it discovers other pages.
   • BManually script the workflow and provide the DAST tool with a recorded session or authentication tokens to traverse the application.
   • CUse a different DAST tool that does not require session handling.
   • DAsk developers to create a special test account that bypasses the workflow.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a best practice for combining SAST and DAST in a DevSecOps pipeline?

   • ARun DAST during development and SAST in production, to cover all phases.
   • BRun SAST only after DAST has completed, to avoid conflicts.
   • CUse only SAST for open-source components and only DAST for custom code.
   • DRun SAST during development and DAST in a staging environment, and correlate findings to prioritize remediation.
   Reveal Solution Discussion Select an answer first