Dynamic Application Security Testing (DAST) Concepts and Tools ECDE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A DevSecOps team is integrating DAST into a CI/CD pipeline that deploys to a Kubernetes cluster. They need to scan the application before it is exposed to the internet. The team has limited resources and cannot maintain a separate staging environment. What is the most efficient approach to run DAST in this pipeline?

   • ARun DAST against the production environment after deployment and before routing traffic.
   • BRun DAST only on the main branch after the application is deployed to production.
   • CUse a local Docker container to run the application and scan it with DAST on the developer's machine.
   • DDeploy the application to a temporary namespace in the Kubernetes cluster, run DAST against the service, and then tear down the namespace.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A DevSecOps team is integrating DAST into their CI/CD pipeline for a Java Spring Boot application that uses OAuth2 for authentication. The team wants to run DAST scans on every pull request before merge. However, the application requires a valid OAuth2 token to access most endpoints. What is the most effective approach to configure the DAST tool for this scenario?

   • AConfigure the DAST tool to use a pre-generated OAuth2 token and set the scan scope to the application's base URL.
   • BUse the DAST tool's built-in crawler to discover endpoints and then manually test each one with a browser.
   • CDisable authentication in the DAST tool and scan only the login page to avoid token management.
   • DRun the DAST scan without authentication but increase the scan depth to cover all endpoints.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   After a DAST scan, the security team finds a critical vulnerability in a legacy application that is scheduled for decommissioning in six months. The development team is busy with a new feature. What should the security team do?

   • ARequire immediate remediation of the vulnerability before any other work.
   • BMove the application to a different environment to reduce exposure.
   • CIgnore the vulnerability because the application is going away.
   • DDocument the risk, accept it with a formal risk acceptance, and monitor the application until decommissioning.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   After running a DAST scan in the CI pipeline, the security team receives a report with 150 findings. The development team is overwhelmed and unsure which issues to fix first. The security team wants to prioritize remediation effectively. What is the best first step?

   • AForward the entire report to the development team and let them decide what to fix.
   • BTriage the findings by severity and exploitability, then assign the top critical issues to the development team.
   • CAutomatically block the release until all 150 findings are fixed.
   • DRe-run the scan with a broader scope to confirm the findings before taking action.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is the purpose of defining a scan scope in a DAST tool?

   • ATo limit the scan to specific URLs or application components, avoiding out-of-scope targets
   • BTo increase the speed of the scan by using multiple threads
   • CTo automatically fix vulnerabilities found during the scan
   • DTo generate a report in a specific format
   Reveal Solution Discussion Select an answer first