SAST and DAST Testing DSE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company wants to implement a comprehensive application security testing program. They have a CI/CD pipeline that builds and deploys a web application. They want to detect vulnerabilities early and also catch runtime issues. Which of the following best represents a comprehensive approach?

   • ARun only SAST in the CI pipeline.
   • BRun only DAST against the production environment.
   • CRun SAST in the CI pipeline and DAST against the staging environment after deployment.
   • DRun SAST and DAST both in the CI pipeline before the build.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A security team is implementing a DevSecOps program and wants to ensure that SAST and DAST findings are properly tracked and remediated. They have a large number of findings and need to prioritize them. What is the best approach?

   • AFix all findings immediately regardless of severity.
   • BIntegrate SAST and DAST findings into a centralized vulnerability management system and assign risk scores based on severity and exploitability.
   • CHave developers manually track findings in a spreadsheet.
   • DOnly track critical findings and ignore all others.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A security architect is evaluating testing tools for a critical application that handles financial transactions. The application is composed of a frontend, a backend API, and a database. The team has access to the source code and a staging environment. They need to identify vulnerabilities that could be exploited by an authenticated user, such as IDOR (Insecure Direct Object References) and business logic flaws. Which testing approach is most effective?

   • AUse SAST only, since it can analyze all code paths and identify IDOR and business logic flaws.
   • BUse a network vulnerability scanner to identify open ports and misconfigurations.
   • CUse DAST without authentication to test only publicly accessible pages.
   • DUse DAST with authenticated scanning to test the running application, and supplement with manual testing for business logic.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which of the following correctly contrasts SAST and DAST?

   • ASAST requires a deployed environment, while DAST can be run during development.
   • BSAST detects runtime configuration issues, while DAST detects coding flaws.
   • CSAST analyzes code without execution, while DAST tests the application while it is running.
   • DSAST is performed on running applications, while DAST is performed on source code.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A security team is conducting DAST on a web application that uses a third-party API. The DAST scanner reports a vulnerability in the API response, but the development team claims the issue is in the third-party API, not their code. The application is deployed in a staging environment. What is the best course of action?

   • AIgnore the finding because it is not in the application's code.
   • BReport the finding to the third-party API provider and wait for them to fix it.
   • CDisable the DAST scanner for the API endpoints.
   • DInvestigate the finding to determine if the application properly validates and sanitizes the API response before using it.
   Reveal Solution Discussion Select an answer first