Dynamic Application Security Testing (DAST) Concepts and Tools ECDE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A team is configuring a DAST tool for a web application that has both a public-facing marketing site and an authenticated customer portal. They want to minimize false positives and ensure the scan covers both areas. What is the best way to configure the scan scope?

   • ADefine two scan scopes: one for the public site and one for the authenticated portal with separate authentication settings.
   • BUse a single scan scope that includes both sites and rely on the scanner to handle authentication automatically.
   • CScan the entire domain without any scope restrictions.
   • DScan only the public site and manually test the portal.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In a DevSecOps culture, what is the role of security teams regarding DAST findings?

   • ATo work collaboratively with developers to triage, prioritize, and remediate findings
   • BTo ignore DAST results because they are the responsibility of the QA team
   • CTo block the pipeline indefinitely until every finding is resolved
   • DTo fix all vulnerabilities themselves without involving developers
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A DevSecOps team is designing a CI/CD pipeline for a web application. They want to run DAST scans early to catch vulnerabilities, but the application requires a database and external services that are only available in a full staging environment. The team has limited resources and cannot spin up a full environment for every commit. What is the best strategy?

   • ARun DAST on every commit against a lightweight containerized version of the app with mocked external services.
   • BRun DAST against a persistent staging environment on a nightly schedule, and run SAST on every commit.
   • CRun DAST only after deployment to production, using a production-like environment.
   • DSkip DAST entirely and rely on SAST and manual penetration testing.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A DAST scan in the CI pipeline reports a critical SQL injection vulnerability in a legacy module. The development team argues that the module is not exposed to the internet and is only used internally. The security team needs to decide how to handle this finding. What is the best course of action?

   • AClose the finding as a false positive because the module is not internet-facing.
   • BValidate the exploitability of the finding in the context of the internal network and prioritize accordingly.
   • CIgnore the finding because the module is legacy and will be replaced soon.
   • DImmediately block the release and require the module to be rewritten.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is a distinguishing characteristic of IAST (Interactive Application Security Testing) compared to DAST?

   • AIAST runs from outside the application and cannot detect vulnerabilities in API endpoints
   • BIAST is a black-box testing method that does not require any access to the application internals
   • CIAST uses agents or sensors inside the application to monitor its execution and identify vulnerabilities in real time
   • DIAST is a static analysis technique that scans source code for known vulnerability patterns
   Reveal Solution Discussion Select an answer first