SAST and DAST Testing DSE Practice Questions (Page 9)

Questions 41–44

1. 41application · medium

   A QA team is about to run DAST on a web application that has just been deployed to a staging environment. The application uses a third-party payment gateway and sends emails via an SMTP server. The team wants to ensure that the DAST scan does not cause unintended side effects. What should they do before starting the scan?

   • ARun the scan against the production environment to get the most accurate results.
   • BUse a SAST tool instead to avoid any runtime side effects.
   • CDisable the payment gateway and email server during the scan.
   • DConfigure the DAST scanner to exclude or simulate interactions with the payment gateway and email server.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which of the following is a recommended way to integrate SAST into a CI/CD pipeline?

   • ARun SAST as a post-deployment step in the production environment.
   • BRun SAST as a separate manual step performed by security engineers only.
   • CRun SAST as an automated step in the build stage, failing the build on critical findings.
   • DRun SAST only on release branches, not on feature branches.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A large organization has multiple development teams using different programming languages and CI/CD tools. The security team wants to standardize SAST across all teams. They have a limited budget and want to minimize the number of tools. What is the most effective strategy?

   • ARun SAST only on the most critical applications and skip others.
   • BUse a single SAST tool that only supports one language and force all teams to use that language.
   • CSelect a SAST tool that supports multiple languages and integrate it into each team's CI pipeline via a shared plugin or API.
   • DRequire each team to choose its own SAST tool and report findings manually.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A development team is integrating SAST into their CI pipeline. They notice that the SAST scan takes 30 minutes, which significantly slows down the pipeline. The team wants to maintain security without delaying releases. What is the best approach?

   • ARemove SAST from the pipeline and rely on DAST only.
   • BRun SAST on a subset of high-risk files on every commit and run a full SAST scan nightly or on merge to the main branch.
   • CRun the full SAST scan only on release branches.
   • DIncrease the build server resources to make the SAST scan faster.
   Reveal Solution Discussion Select an answer first