A team is considering adding DAST to their CI/CD pipeline. They currently use SAST and dependency scanning. They want to identify vulnerabilities that are only visible when the application is running, such as misconfigurations and business logic flaws. What is the best reason to add DAST?

DAST is faster than SAST and can be run on every commit.

DAST can replace SAST and dependency scanning.

DAST does not require a running application, so it can be run earlier in the pipeline.

DAST tests the running application and can detect runtime-specific issues like misconfigurations and business logic flaws.

A company has a DevSecOps culture where developers are responsible for fixing security findings. However, the security team notices that developers often close DAST findings as 'false positive' without proper investigation. What should the security team do to ensure findings are properly addressed?

Increase the frequency of DAST scans to catch more issues.

Implement a process where developers must provide evidence or a reason before closing a finding.

Remove developers' ability to close findings and have security team close them all.

Disable the 'false positive' option in the tracking system.

A team is comparing DAST and IAST for their CI/CD pipeline. They want to identify vulnerabilities in their Java application during automated tests. The application is complex and has many internal components. Which approach would provide the most comprehensive coverage during the test stage?

Use IAST because it instruments the application and monitors code execution during tests, providing detailed runtime analysis.

Use DAST and SAST together but not IAST.

Use DAST because it tests the application from the outside and does not require code changes.

Use SAST because it scans the source code and does not require a running application.

A DAST scan of a web application is producing many false positives for a form that uses a CAPTCHA. The scanner cannot submit the form because it cannot solve the CAPTCHA. What should the team do to improve scan accuracy?

Increase the scan timeout to give the scanner more time to solve the CAPTCHA.

Use a different DAST tool that has built-in CAPTCHA solving.

Exclude the entire form from the scan scope.

Configure the DAST tool to bypass the CAPTCHA by using a test hook or disabling it in the test environment.

When analyzing a DAST report, which factor should be used to prioritize which vulnerability to fix first?

The severity rating combined with the exploitability and business impact of the vulnerability

The name of the developer who wrote the affected code

The order in which the vulnerabilities appear in the report

The number of lines of code in the affected module

EC-CouncilCertified DevSecOps Engineer

Domain 4Objective 1

Dynamic Application Security Testing (DAST) Concepts and Tools ECDE Practice Questions (Page 2)

Part of the Test Stage: DAST and CI/CD Security domain, which makes up ~9% of our current practice bank.

43questions here

9free pages

7concepts

Questions 6–10

6application · medium
A team is considering adding DAST to their CI/CD pipeline. They currently use SAST and dependency scanning. They want to identify vulnerabilities that are only visible when the application is running, such as misconfigurations and business logic flaws. What is the best reason to add DAST?
Select an answer first
7expert · hard
A company has a DevSecOps culture where developers are responsible for fixing security findings. However, the security team notices that developers often close DAST findings as 'false positive' without proper investigation. What should the security team do to ensure findings are properly addressed?
Select an answer first
8application · medium
A team is comparing DAST and IAST for their CI/CD pipeline. They want to identify vulnerabilities in their Java application during automated tests. The application is complex and has many internal components. Which approach would provide the most comprehensive coverage during the test stage?
Select an answer first
9application · medium
A DAST scan of a web application is producing many false positives for a form that uses a CAPTCHA. The scanner cannot submit the form because it cannot solve the CAPTCHA. What should the team do to improve scan accuracy?
Select an answer first
10foundation · easy
When analyzing a DAST report, which factor should be used to prioritize which vulnerability to fix first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECDE” is a trademark of its owner, used for identification only.