Which of the following is a required configuration for a DAST scan?

The target URL of the running application

The CI/CD pipeline definition file

After running a DAST scan, a security analyst reviews the report and finds a vulnerability flagged as 'High' severity with evidence showing a reflected XSS payload in a URL parameter. The analyst checks the application code and confirms that the parameter is properly encoded before being rendered. What should the analyst do next?

Mark the finding as a false positive in the DAST tool and document the evidence and reasoning for the decision.

Re-run the DAST scan with a different scan profile to see if the vulnerability is still detected.

Ignore the finding because DAST results are unreliable and should not be trusted.

Immediately create a high-priority remediation ticket for the development team to fix the XSS vulnerability.

Which of the following is a key difference between SAST and DAST?

SAST is performed from the outside, while DAST is performed from the inside

SAST detects runtime vulnerabilities, while DAST detects code-level flaws

SAST analyzes source code, while DAST tests a running application

SAST requires a running application, while DAST analyzes source code

A security team is implementing DAST for a web application that heavily uses JavaScript to render content dynamically. The team is concerned that the DAST scanner may not be able to crawl all the dynamic content. What should they do to mitigate this limitation?

Disable JavaScript in the scanner to avoid errors and focus on static content.

Increase the scan duration to give the scanner more time to discover dynamic content.

Configure the DAST scanner to use a headless browser to render JavaScript and crawl the dynamically generated content.

Accept the limitation and rely on SAST to cover the dynamic content.

Which type of vulnerability is DAST specifically well-suited to detect?

SQL injection in a live web application

Insecure cryptographic algorithms in code

Missing input validation in source code

Hardcoded credentials in source code

GitLabCertified Security Associate

Domain 1Objective 2

Implement Dynamic Application Security Testing (DAST) GITLAB-CERTIFIED-SECURITY-SPECIALIST Practice Questions (Page 3)

Part of the Static and Dynamic Application Security Testing domain, which makes up ~19% of our current practice bank.

23questions here

5free pages

8concepts

Questions 11–15

11foundation · easy
Which of the following is a required configuration for a DAST scan?
Select an answer first
12application · medium
After running a DAST scan, a security analyst reviews the report and finds a vulnerability flagged as 'High' severity with evidence showing a reflected XSS payload in a URL parameter. The analyst checks the application code and confirms that the parameter is properly encoded before being rendered. What should the analyst do next?
Select an answer first
13foundation · easy
Which of the following is a key difference between SAST and DAST?
Select an answer first
14application · medium
A security team is implementing DAST for a web application that heavily uses JavaScript to render content dynamically. The team is concerned that the DAST scanner may not be able to crawl all the dynamic content. What should they do to mitigate this limitation?
Select an answer first
15foundation · easy
Which type of vulnerability is DAST specifically well-suited to detect?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GITLAB-CERTIFIED-SECURITY-SPECIALIST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitLab. “GITLAB-CERTIFIED-SECURITY-SPECIALIST” is a trademark of its owner, used for identification only.