Dynamic Application Security Testing (DAST) Concepts and Tools ECDE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   How does DAST differ from SAST in terms of when it can be performed in the software development lifecycle?

   • ADAST requires a deployed and running application, while SAST can be performed on source code before compilation
   • BBoth DAST and SAST must be performed after the application is deployed to production
   • CDAST is performed during development, while SAST is performed during runtime
   • DDAST can be run before the application is compiled, while SAST requires a running instance
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company is building a new REST API that uses OAuth2 for authentication and plans to deploy it on Kubernetes. The DevSecOps team needs to select a DAST tool that can be integrated into their GitLab CI pipeline and can authenticate to the API to scan authenticated endpoints. Which tool selection is most appropriate?

   • AA network vulnerability scanner that checks open ports and service versions.
   • BA DAST tool that only supports basic authentication and runs as a standalone CLI.
   • CA commercial DAST tool that supports OAuth2 authentication and provides a GitLab CI plugin.
   • DAn open-source SAST tool that scans source code for security flaws.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A team is evaluating testing tools for a microservices architecture where each service is developed independently and deployed frequently. They want to catch runtime vulnerabilities that depend on how services interact. Which testing approach is most suitable?

   • AManual penetration testing only, since automated tools cannot handle microservices.
   • BSAST on each service's source code.
   • CIAST on a single service without deploying the full environment.
   • DDAST against a deployed environment that includes all services.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which practice best supports a collaborative DevSecOps approach to DAST?

   • AIncluding developers in the review of DAST results and remediation planning
   • BUsing DAST as a replacement for manual code reviews
   • CKeeping DAST results confidential from developers to avoid alarming them
   • DRunning DAST scans only after a security incident occurs
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security team runs DAST scans and generates reports with many findings. Developers complain that the reports are too technical and do not provide actionable steps. The team wants to improve the remediation workflow. What is the most effective approach?

   • ASend the raw DAST report to developers and let them interpret it.
   • BProvide a summary of the top 10 risks with business impact and suggested fixes in the report.
   • COnly report critical findings and ignore medium and low ones.
   • DAutomatically create a ticket for every finding without any context.
   Reveal Solution Discussion Select an answer first