Dynamic Application Security Testing (DAST) Concepts and Tools ECDE Practice Questions (Page 9)

Questions 41–43

1. 41foundation · easy

   In a CI/CD pipeline, at which stage is DAST most appropriately integrated?

   • AAfter the application is deployed to a staging environment, but before production release
   • BOnly in production, because DAST requires real user traffic to be effective
   • CBefore code compilation, as part of the build stage
   • DDuring the code review stage, before the code is committed to the repository
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Why is it important to configure authentication in a DAST tool before scanning an application?

   • ATo reduce the number of false positives by using a valid session
   • BTo ensure the scanner can access all parts of the application that require login
   • CTo allow the scanner to test the application's login page for vulnerabilities
   • DTo prevent the scanner from being blocked by the application's firewall
   Reveal Solution Discussion Select an answer first
3. 43expert · hard

   A security team has implemented DAST in the CI pipeline, but developers are ignoring the findings because they are not integrated into their workflow. The team wants to improve collaboration and ensure that DAST findings are addressed. What is the most effective strategy?

   • AIntegrate DAST findings into the developers' existing issue tracker with clear ownership and severity levels.
   • BSend a weekly email summary of DAST findings to the development team.
   • CBlock the pipeline for any DAST finding, regardless of severity.
   • DRequire developers to run DAST scans manually before every commit.
   Reveal Solution Discussion Select an answer first