SAST and DAST Testing DSE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   When interpreting DAST results, what is the significance of a finding that shows a 200 OK response to a SQL injection payload?

   • AIt indicates a potential SQL injection vulnerability that requires further investigation.
   • BIt means the DAST tool is not working correctly.
   • CIt proves the application is secure against SQL injection.
   • DIt confirms that the SQL injection was successful and data was exfiltrated.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company is adopting a DevSecOps culture and wants to implement security testing across their application lifecycle. They have a microservices architecture with frequent releases. The team wants to minimize false positives while ensuring that vulnerabilities are caught as early as possible. Which strategy best aligns with these goals?

   • ARun DAST on every commit and SAST only during major releases.
   • BRun SAST on every commit and DAST on a scheduled basis against the staging environment.
   • CRun both SAST and DAST only in the production environment.
   • DRun SAST only on release branches and DAST only in production.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   In which phase of the SDLC is DAST typically performed?

   • AAfter the application is deployed to a test or staging environment.
   • BDuring the coding phase, as soon as the first lines of code are written.
   • COnly after the application has been in production for several months.
   • DDuring the requirements gathering phase, before development begins.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company is implementing SAST in their CI/CD pipeline. They have a large codebase with multiple modules, and the SAST scan takes a long time, slowing down the pipeline. The team wants to reduce scan time without significantly reducing security coverage. What is the most effective approach?

   • ARun SAST on changed files only for pull requests, and run full scans on the main branch.
   • BRun SAST only on the production build artifact.
   • CRun SAST only on the main branch and skip pull request scans entirely.
   • DIncrease the number of SAST rules to catch more vulnerabilities, even if it takes longer.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A team uses a SAST tool that generates a large number of findings. Developers are overwhelmed and often ignore the reports. The security lead wants to reduce noise and ensure that real vulnerabilities are fixed promptly. Which approach is most effective?

   • ARun SAST only once a month and have the security team manually review all findings.
   • BDisable all SAST rules except for the most critical ones to reduce the number of findings.
   • CAutomatically suppress all findings that are older than 30 days.
   • DConfigure the SAST tool to fail the build only on high-confidence, critical findings and provide a triage dashboard for developers.
   Reveal Solution Discussion Select an answer first