Dynamic Application Security Testing (DAST) Concepts and Tools ECDE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A team is deciding between SAST, DAST, and IAST for a new application. They want to catch vulnerabilities early in the development cycle but also need to test the application's runtime behavior. The team has a tight budget and cannot afford multiple tools. Which approach provides the best balance?

   • AUse DAST only, since it tests the running application and catches runtime issues.
   • BUse IAST, which combines source analysis with runtime instrumentation, providing both early and runtime coverage.
   • CUse SAST only, since it can be integrated into the IDE and catches issues early.
   • DUse manual penetration testing only, since it is the most thorough.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company is evaluating DAST tools for their CI/CD pipeline. Their application is a single-page application (SPA) that heavily uses JavaScript and communicates with a REST API. The team needs a DAST tool that can effectively scan the SPA and the API. What is the most important feature to look for in a DAST tool?

   • AIntegration with SAST tools to combine results.
   • BAbility to scan only static HTML pages without executing JavaScript.
   • CLow cost and open-source license.
   • DSupport for modern JavaScript frameworks and API scanning capabilities.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A large enterprise has multiple applications: a legacy SOAP-based web service, a modern React SPA with a REST API, and a mobile app backend. The team needs to select a single DAST tool that can be integrated into their Jenkins pipeline and support all these technologies. Which tool capability is most critical for this selection?

   • AA user-friendly GUI for manual testing.
   • BSupport for both SOAP and REST API testing, along with a Jenkins plugin.
   • CLow cost and open-source licensing.
   • DThe ability to scan mobile app binaries.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security team is introducing DAST into their organization's DevSecOps culture. Developers are concerned that DAST scans will slow down the CI pipeline and produce too many false positives. What is the best way to address these concerns and foster collaboration?

   • AUse DAST results to penalize developers for introducing vulnerabilities.
   • BRun DAST scans only on the main branch and share the results with developers after deployment.
   • CStart with a pilot project, tune the DAST tool to reduce false positives, and provide training to developers on interpreting results.
   • DDisable DAST scans until the tool is perfect and produces no false positives.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A team wants to add DAST to their CI/CD pipeline but is concerned about slowing down the build. They decide to run DAST only on merge requests that affect the web application. Which practice best aligns with this goal?

   • ARun a full DAST scan on every merge request, regardless of changes.
   • BRun DAST only on the main branch after merge, not on merge requests.
   • CRun DAST on a schedule, independent of merge requests.
   • DUse a CI trigger that runs DAST only when files in the web application directory change.
   Reveal Solution Discussion Select an answer first