During the scanning phase of a DAST workflow, what does the tool primarily do?

It reviews the source code for security flaws

It generates a report of all discovered URLs

It sends malicious payloads to the discovered endpoints to identify vulnerabilities

It authenticates to the application using provided credentials

What is a false positive in the context of DAST?

A vulnerability that exists but is not detected by the scanner

A vulnerability that is fixed but still reported

A vulnerability that is detected but has low severity

A reported vulnerability that does not actually exist

What is a common limitation of DAST?

It requires access to the source code to run

It can only be run on production environments

It may not cover all parts of the application, especially those that require complex user interactions

It cannot detect vulnerabilities that require authentication

A security analyst is reviewing a DAST report and finds a vulnerability with a 'High' severity rating. The evidence shows that the vulnerability was detected in a parameter that is only used in a legacy feature that is no longer accessible from the main application. The analyst checks the application and confirms that the feature is still accessible via a direct URL. What should the analyst do?

Ignore the finding because it is in a legacy feature that is not used.

Mark the finding as a false positive because the feature is not linked from the main application.

Treat the finding as a real vulnerability and create a remediation ticket, noting that the feature is still accessible via a direct URL.

Re-run the DAST scan with a different scan profile to see if the vulnerability is still detected.

After fixing a vulnerability identified by DAST, what is the recommended next step?

Re-run the DAST scan to verify the fix

Close the vulnerability without further action

GitLabCertified Security Associate

Domain 1Objective 2

Implement Dynamic Application Security Testing (DAST) GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 2)

Part of the Static and Dynamic Application Security Testing domain, which makes up ~19% of our current practice bank.

23questions here

5free pages

8concepts

Questions 6–10

6foundation · easy
During the scanning phase of a DAST workflow, what does the tool primarily do?
Select an answer first
7foundation · easy
What is a false positive in the context of DAST?
Select an answer first
8foundation · easy
What is a common limitation of DAST?
Select an answer first
9expert · medium
A security analyst is reviewing a DAST report and finds a vulnerability with a 'High' severity rating. The evidence shows that the vulnerability was detected in a parameter that is only used in a legacy feature that is no longer accessible from the main application. The analyst checks the application and confirms that the feature is still accessible via a direct URL. What should the analyst do?
Select an answer first
10foundation · easy
After fixing a vulnerability identified by DAST, what is the recommended next step?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GITLAB-CERTIFIED-SECURITY-SPECIALIST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitLab. “GITLAB-CERTIFIED-SECURITY-SPECIALIST” is a trademark of its owner, used for identification only.