Dynamic Application Security Testing (DAST) Concepts and Tools ECDE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of Dynamic Application Security Testing (DAST) in a CI/CD pipeline?

   • ATo instrument the application at runtime to monitor internal data flow and identify vulnerabilities
   • BTo test a running application by simulating external attacks and observing its responses
   • CTo analyze source code for vulnerabilities without executing the application
   • DTo scan container images for known vulnerabilities in base images and dependencies
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A development team is debating whether to use SAST or DAST for their CI/CD pipeline. They have a Node.js application with many third-party libraries and they want to identify vulnerabilities that are only exploitable at runtime, such as SQL injection and cross-site scripting. Which approach should they choose?

   • AUse IAST because it combines source code analysis with runtime monitoring and is always the best choice.
   • BUse DAST because it tests the running application and can identify runtime vulnerabilities like SQL injection and XSS.
   • CUse both SAST and DAST but run DAST only after deployment to production.
   • DUse SAST because it scans the source code and can find all vulnerabilities including runtime ones.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A DAST scan has identified a cross-site scripting (XSS) vulnerability in a web application. The development team is unsure how to reproduce the issue. What is the best way to help the developers understand and fix the vulnerability?

   • AAsk the developers to manually test the application to find the vulnerability.
   • BProvide the DAST report with the exact request and response that triggered the vulnerability, along with a suggested fix.
   • CClose the finding as a false positive because the developers cannot reproduce it.
   • DEscalate the finding to management without involving the developers.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   When DAST identifies a vulnerability in a CI/CD pipeline, what is the recommended first step for handling the result?

   • AImmediately block the pipeline and halt all development until the vulnerability is fixed
   • BIgnore the finding because DAST is known to produce many false positives
   • CAutomatically deploy the fix to production without manual review
   • DTriage the finding to confirm it is a real vulnerability and assess its severity and exploitability
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the best way to communicate a DAST finding to a developer who is not a security specialist?

   • ASend the report to the developer's manager and ask them to assign the fix
   • BExplain the vulnerability in terms of the affected functionality, the potential impact, and a suggested remediation
   • CProvide the raw scan log with all technical details and let the developer figure it out
   • DFile a bug report with only the vulnerability title and no additional context
   Reveal Solution Discussion Select an answer first