A security team is deciding which type of application security testing to implement for a legacy web application that has no source code available. The application is deployed and running in production. The team needs to identify vulnerabilities that an attacker could exploit against the running application. Which testing approach should they choose?

Static Application Security Testing (SAST) because it can analyze the compiled binary without source code.

Software Composition Analysis (SCA) because it scans the application's dependencies for known vulnerabilities.

Interactive Application Security Testing (IAST) because it combines static and dynamic analysis.

Dynamic Application Security Testing (DAST) because it tests the running application without requiring source code.

What is a common remediation strategy for a SQL injection vulnerability found by DAST?

Increase the logging level for the application

Add a web application firewall (WAF) rule to block the attack

Use parameterized queries or prepared statements

A security analyst is reviewing a DAST report and finds a vulnerability with a 'Medium' severity rating. The evidence shows that the vulnerability was detected in a legacy endpoint that is no longer used by the application. What should the analyst do?

Create a high-priority ticket to remediate the vulnerability immediately.

Verify whether the endpoint is still accessible and, if not, mark the finding as a false positive or note it as a non-issue.

Re-run the DAST scan with a different scan profile to see if the vulnerability is still detected.

Ignore the finding because it is only 'Medium' severity.

How is DAST typically integrated into GitLab CI/CD?

By adding a DAST job that uses a predefined template

By running DAST manually after the pipeline completes

By configuring a webhook to an external DAST service

By installing a plugin in the GitLab server

What is the purpose of the 'evidence' provided in a DAST scan result?

To provide a proof that the vulnerability exists, such as the request and response that triggered it

To show the exact source code line where the vulnerability exists

To list all the files that were scanned during the DAST test

To show the credentials used during the scan

GitLabCertified Security Associate

Domain 1Objective 2

Implement Dynamic Application Security Testing (DAST) GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 1)

Part of the Static and Dynamic Application Security Testing domain, which makes up ~19% of our current practice bank.

23questions here

5free pages

8concepts

Questions 1–5

1application · medium
A security team is deciding which type of application security testing to implement for a legacy web application that has no source code available. The application is deployed and running in production. The team needs to identify vulnerabilities that an attacker could exploit against the running application. Which testing approach should they choose?
Select an answer first
2foundation · easy
What is a common remediation strategy for a SQL injection vulnerability found by DAST?
Select an answer first
3application · medium
A security analyst is reviewing a DAST report and finds a vulnerability with a 'Medium' severity rating. The evidence shows that the vulnerability was detected in a legacy endpoint that is no longer used by the application. What should the analyst do?
Select an answer first
4foundation · easy
How is DAST typically integrated into GitLab CI/CD?
Select an answer first
5foundation · easy
What is the purpose of the 'evidence' provided in a DAST scan result?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GITLAB-CERTIFIED-SECURITY-SPECIALIST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitLab. “GITLAB-CERTIFIED-SECURITY-SPECIALIST” is a trademark of its owner, used for identification only.