Dynamic Application Security Testing (DAST) Concepts and Tools ECDE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is a key limitation of DAST that a DevSecOps engineer should consider when integrating it into a CI/CD pipeline?

   • AIt produces a high number of false positives because it relies on static analysis rules
   • BIt cannot be automated and must be run manually by a security expert
   • CIt can only detect vulnerabilities that are visible through the application's external interface
   • DIt requires access to the application's source code to identify vulnerabilities
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A startup with a small budget needs to integrate DAST into its CI/CD pipeline. The team is comfortable with open-source tools and uses GitHub Actions. The application is a simple CRUD web app with basic authentication. Which DAST tool choice is most appropriate?

   • AA commercial enterprise DAST tool with advanced features and dedicated support.
   • BA cloud-based DAST service that requires a monthly subscription and provides a managed scanner.
   • CA custom-built scanner using a scripting language to test the application.
   • DAn open-source DAST tool like OWASP ZAP, configured with a GitHub Action and basic authentication.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   When evaluating DAST tools for integration into a CI/CD pipeline, which capability is essential for automated security testing?

   • AA built-in vulnerability database that is updated manually by the user
   • BA graphical user interface for manual testing
   • CA command-line interface or REST API that allows the tool to be invoked from build scripts
   • DThe ability to run only on Windows operating systems
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A DAST scan of a web application is missing many pages because the application uses JavaScript to render content dynamically. The scanner only sees the initial HTML and does not execute JavaScript. What should the team configure to improve scan coverage?

   • AEnable the DAST tool's headless browser or JavaScript rendering engine.
   • BIncrease the number of scan threads to speed up the scan.
   • CUse a different DAST tool that does not support JavaScript.
   • DAdd more URLs to the scan scope manually.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company is selecting a DAST tool for a microservices architecture with multiple services that communicate via REST APIs. The team wants to scan the entire application, but each service has its own authentication mechanism. They also need to integrate the tool into their CI/CD pipeline with minimal false positives. What is the most important consideration when selecting a DAST tool?

   • AThe tool must have a built-in vulnerability database that is updated daily.
   • BThe tool must be open-source to reduce costs.
   • CThe tool must be able to scan the entire domain without any scope restrictions.
   • DThe tool must support API scanning and allow configuration of multiple authentication profiles for different services.
   Reveal Solution Discussion Select an answer first