Dynamic Application Security Testing (DAST) Concepts and Tools ECDE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A DAST scan in the CI pipeline reports a high-severity vulnerability in a third-party component that the application uses. The development team says the component is not directly accessible to users and the vulnerability is not exploitable in their context. The security team needs to decide whether to block the release. What is the best approach?

   • APerform a manual verification of the exploitability in the application's context and, if not exploitable, document the finding and proceed.
   • BIgnore the finding because it is in a third-party component and not the team's responsibility.
   • CAutomatically patch the third-party component without testing to remove the vulnerability.
   • DBlock the release immediately because the vulnerability is high severity.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A DAST scan of a web application reports a high volume of 'SQL Injection' findings on login and search forms. The security team suspects many are false positives because the application uses parameterized queries. What should the team do to reduce false positives while maintaining coverage?

   • AIncrease the scan depth and intensity to get more evidence for each finding.
   • BConfigure the DAST tool to exclude the login and search forms from the scan scope.
   • CManually review each finding and mark them all as 'Not Exploitable' in the tracking system.
   • DAdjust the DAST tool's attack patterns and validation rules to better match the application's use of parameterized queries.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A team is configuring a DAST tool for an application that has a large number of endpoints. The scan is taking too long and is causing CI pipeline delays. The team wants to reduce scan time without significantly reducing coverage. What is the best approach?

   • ADisable authentication to reduce the number of endpoints scanned.
   • BIncrease the number of concurrent requests in the DAST tool to speed up the scan.
   • CRun DAST scans only on the main branch after deployment.
   • DPrioritize scanning critical endpoints and use a smaller scan scope for routine scans, with full scans scheduled less frequently.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security team runs DAST scans and sends a long PDF report to developers via email after each scan. Developers rarely read the reports and often ignore the findings. What should the team do to improve collaboration and remediation?

   • ACreate a shared dashboard with the top findings and hold a brief triage meeting with developers after each scan.
   • BAutomatically file a ticket for each finding without any context.
   • CStop running DAST scans because developers ignore the results.
   • DSend the PDF report to the development manager instead of the developers.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company is selecting a DAST tool for a large, complex web application that uses WebSockets for real-time features. The team needs the tool to support WebSocket testing and integrate with their Azure DevOps pipeline. They also need to handle session management for authenticated areas. Which tool capability is most important to evaluate?

   • AThe ability to generate PDF reports.
   • BSupport for WebSocket protocol testing and session handling.
   • CLow false-positive rate on standard vulnerabilities.
   • DA large number of built-in vulnerability checks.
   Reveal Solution Discussion Select an answer first