SAST and DAST Testing DSE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security architect is designing a comprehensive testing program for a large enterprise with many applications. The architect wants to ensure that all applications are tested, but resources are limited. Some applications are in active development, some are legacy and running, and some are third-party products. Which testing strategy is most appropriate?

   • AUse SAST for in-house developed applications, DAST for legacy and third-party applications, and prioritize based on risk.
   • BTest only the applications that are publicly accessible.
   • CUse DAST for all applications, regardless of source code availability.
   • DUse SAST for all applications, including third-party products.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   When interpreting SAST findings, what should a developer do first?

   • AIgnore all findings because SAST tools are unreliable.
   • BImmediately fix every reported issue without further analysis.
   • CEscalate all findings to the security team without looking at them.
   • DReview the finding to determine if it is a true positive and understand the context.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A development team is preparing to release a web application that processes sensitive user data. They want to catch as many security defects as possible before deployment, but they also need to verify that the application behaves securely when fully assembled and running. The team has limited time in the release cycle and must choose a testing approach that provides both early feedback and runtime validation. Which combination of testing practices best meets this need?

   • ARun DAST on the source code repository and SAST against the production application after release.
   • BRun DAST only, since it tests the application as users would interact with it and covers all code paths.
   • CRun SAST on the source code during the build phase and DAST against a staging deployment before release.
   • DRun SAST only, since it can identify all security issues without needing a deployed environment.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security analyst is running DAST on a web application and receives a finding that indicates a SQL injection vulnerability. The analyst wants to confirm the finding before reporting it. What is the most appropriate next step?

   • ARun the same DAST scan again to see if the finding repeats.
   • BManually verify the finding by sending a crafted request to the same endpoint and observing the response.
   • CImmediately report the finding to the development team without further investigation.
   • DIgnore the finding because DAST is known to produce false positives.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary characteristic of Dynamic Application Security Testing (DAST)?

   • AIt tests the application from the outside while it is running, without access to the source code.
   • BIt scans the source code for known vulnerability patterns.
   • CIt reviews the application's architecture and design documents.
   • DIt inspects the application's container image for insecure base images.
   Reveal Solution Discussion Select an answer first