SAST and DAST Testing DSE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Why is it a best practice to use both SAST and DAST in an application security program?

   • ABecause DAST is faster than SAST, so using both speeds up the overall testing process.
   • BBecause SAST and DAST detect exactly the same vulnerabilities, so using both provides redundancy.
   • CBecause SAST covers code-level issues early in the SDLC, while DAST covers runtime issues later, providing broader coverage.
   • DBecause SAST is sufficient for all security testing, and DAST is only needed for compliance.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which type of vulnerability is DAST more likely to detect than SAST?

   • ASQL injection in a code path that is never executed.
   • BA hardcoded API key in the source code.
   • CA missing input validation in a function that is only called with invalid data at runtime.
   • DA buffer overflow in a library that is not reachable from the application's entry points.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company is developing a customer-facing web application that will be subject to strict compliance requirements. The security team wants to ensure that the application is thoroughly tested before launch. They have a limited budget and must choose between investing in SAST, DAST, or a combination. The application has a complex authorization model and handles sensitive personal data. Which testing strategy provides the most comprehensive coverage within the budget?

   • ARely on external penetration testing once before launch.
   • BInvest only in DAST because it tests the application as users interact with it.
   • CImplement SAST in the CI pipeline and conduct DAST on staging builds, with manual penetration testing for critical flows.
   • DInvest only in SAST because it is cheaper and can be automated.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard · select all that apply

   A security team is designing a comprehensive application security testing program for a web application that is developed using agile methodology with frequent releases. They want to integrate security testing into the CI/CD pipeline. Which of the following practices should they implement? Select all that apply.

   • ARun DAST against a staging environment after each deployment to catch runtime issues.
   • BUse a centralized dashboard to track and prioritize findings from both SAST and DAST.
   • CRun SAST on every commit to catch code-level vulnerabilities early.
   • DRun DAST on every commit in the CI pipeline.
   Check answers Discussion Select an answer first
6. 30foundation · easy

   Which statement best describes Static Application Security Testing (SAST)?

   • AIt monitors production traffic to detect active exploitation attempts.
   • BIt sends malicious payloads to a running application to identify vulnerabilities.
   • CIt reviews the configuration of the deployment environment for security misconfigurations.
   • DIt analyzes source code or binaries without executing the application.
   Reveal Solution Discussion Select an answer first