VAPT Strategy ECDE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A DevSecOps team is integrating security testing into their CI/CD pipeline. They have a mix of applications: a legacy monolithic app that is rarely updated and a new microservices-based app that is updated frequently. They want to avoid slowing down the pipeline for the microservices app while still ensuring security. What is the best approach?

   • ARun security testing only on the microservices app because it is newer.
   • BRun a fast SAST scan on every build for the microservices app, and run a more comprehensive DAST scan on the legacy app only when it changes.
   • CRun the same comprehensive security testing on every build for both apps.
   • DRun a manual penetration test on every release of both apps.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   After a penetration test, the report lists a critical SQL injection in a customer-facing API and a medium-severity missing security header in the web application. The team has limited development capacity this sprint. What should the DevSecOps engineer recommend?

   • AFix the SQL injection first, then schedule a retest of the API endpoint before the next release.
   • BFix the missing security header first because it is a quick change, and defer the SQL injection to the next sprint.
   • CRetest both findings immediately without any fixes to confirm the report is accurate.
   • DAccept both risks and document them in the risk register without scheduling remediation.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A company is planning a penetration test for a critical application. The test must be performed during a maintenance window that is only available on weekends. The application is used globally, and the maintenance window is limited to 4 hours. The team wants to maximize coverage of the application's attack surface. What is the most important consideration?

   • ASkip the penetration test and rely on the last vulnerability assessment.
   • BPrioritize testing based on the risk and likelihood of exploitation, focusing on the most critical functionalities first.
   • CExtend the maintenance window to ensure full coverage.
   • DRun all automated scanning tools simultaneously to cover as much as possible.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A team wants to integrate security testing into their CI/CD pipeline. They have a fast-moving microservices architecture with frequent deployments. They need to catch vulnerabilities early without slowing down the pipeline, but they also need to avoid false positives that would block releases. Which strategy best balances these concerns?

   • ARun SAST on every commit but configure it to never fail the build, and send all findings to a dashboard for review.
   • BRun only a manual penetration test once a month, and do not integrate any automated scanning into the pipeline.
   • CRun SAST and dependency scanning in parallel on every commit, and fail the build only on critical or high-confidence findings.
   • DRun a full DAST scan against a production-like environment after every deployment, and block the release if any finding is reported.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A DevSecOps engineer is planning a VAPT for a payment-processing application that handles cardholder data. The compliance team requires a test that validates the effectiveness of security controls against realistic attack paths, not just the presence of known weaknesses. The testing window is limited to off-peak hours, and the scope must exclude the third-party payment gateway. Which approach should the engineer choose?

   • AExecute a full-scope penetration test without time restrictions to maximize coverage, and document any findings related to the payment gateway separately.
   • BPerform an OSSTMM-based security audit that includes the payment gateway as an in-scope asset to ensure end-to-end coverage of the transaction flow.
   • CRun an authenticated vulnerability scan with a credentialed scanner during the off-peak window, then manually verify each finding against the payment gateway's API documentation.
   • DConduct a penetration test using the PTES methodology, with rules of engagement that explicitly exclude the third-party gateway and restrict active testing to the off-peak window.
   Reveal Solution Discussion Select an answer first