Dynamic Application Security Testing

Final Quiz

Connecting to LMS... Progress: in progress

Assessment

1. What is Dynamic Application Security Testing? A. Security testing of a running application from an external or runtime perspective. B. A source code formatting process. C. A password storage algorithm. D. A replacement for all security practices.

2. How does DAST differ from SAST? A. DAST reviews source code without running the application. B. DAST tests observable behavior in a running application, while SAST analyzes code or artifacts. C. DAST only reviews dependency licenses. D. DAST replaces secure code review entirely.

3. Why is authorization required before DAST? A. Authorization is only needed after findings are reported. B. Authorization makes evidence unnecessary. C. DAST may interact with live application behavior and must be limited to approved systems, users, timing, and techniques. D. Unauthorized testing is always more accurate.

4. What should a DAST test plan define? A. Only the scanner logo. B. Only the final report font. C. Only the number of screenshots. D. Scope, environment, timing, accounts, exclusions, contacts, safety limits, and data handling expectations.

5. Why is application coverage important? A. DAST can only evaluate what it can reach, crawl, authenticate to, or exercise through known routes and endpoints. B. Coverage guarantees no vulnerabilities exist. C. Coverage replaces remediation. D. Coverage is unrelated to findings.

6. What is authenticated DAST useful for? A. Testing only public landing pages. B. Finding issues in logged-in workflows, role-specific functionality, and session-based behavior. C. Replacing access control. D. Avoiding test accounts.

7. Why should DAST test credentials be protected? A. Test credentials are always public. B. Credentials should be stored in plaintext logs. C. Test credentials and tokens may provide access to application functionality and sensitive test data. D. Credentials remove the need for authorization.

8. What is a passive DAST check? A. A destructive database operation. B. A manual source code review. C. A production deployment. D. A check that observes responses, headers, cookies, errors, or configuration signals without actively mutating behavior.

9. What is an active DAST check? A. A check that sends controlled test inputs or modified requests to evaluate runtime behavior. B. A code formatting rule. C. A backup process. D. A user training reminder.

10. Why should active testing be controlled carefully? A. Active testing is always harmless. B. Active testing may affect application state, logs, rate limits, accounts, data, or operational behavior. C. Active testing removes the need for scope. D. Active testing should ignore approvals.

11. Why are APIs important in DAST? A. APIs cannot have vulnerabilities. B. APIs are unrelated to authentication. C. Modern applications often expose security-sensitive behavior through API endpoints used by web, mobile, and service clients. D. APIs do not need testing.

12. What is object-level access control testing concerned with? A. Whether the UI uses enough icons. B. Whether the scanner has a dark mode. C. Whether code comments are formatted. D. Whether users can access only the records, objects, tenants, or resources they are authorized to access.

13. What is a DAST finding? A. A potential issue identified from runtime behavior that requires review, context, and disposition. B. A guaranteed breach. C. A final legal conclusion. D. A replacement for developer ownership.

14. What is a false positive? A. A real issue missed by the tool. B. A reported issue that does not apply as described after review. C. A confirmed incident. D. A release approval.

15. Why is retesting important after remediation? A. It replaces all future scanning. B. It proves the application has no remaining risk. C. It helps confirm that the issue was actually fixed and that the application behavior changed as expected. D. It removes the need for evidence.

16. Which statement best summarizes DAST? A. DAST is only source code review. B. DAST guarantees perfect application security. C. DAST should be run against any target without permission. D. DAST is an authorized, runtime application testing practice that helps identify observable security issues and supports triage, remediation, validation, and continuous improvement.