312-97: EC-Council Certified DevSecOps Engineer (ECDE)Demo

By ECCouncil · Question Mode

QuestionQ61

Introduction to DevSecOps

Debra Aniston has recently joined a multinational company as a DevSecOps engineer. Her organization builds various types of software products and web applications. The DevSecOps team lead gave her an application's code and asked her to identify and fix security issues in it. Using the w3af tool, Debra was able to detect cross-site scripting and SQL injection vulnerabilities in the source code.

Based on this scenario, which category of security testing tools does w3af belong to?

  • A DAST
  • B SAST
  • C IAST
  • D SCA
Explanation

w3af scans a running (deployed) web application from the outside by sending various attack payloads and observing the application's responses, without needing access to its internal source code. This black-box, runtime-based approach to finding vulnerabilities such as XSS and SQL injection is characteristic of Dynamic Application Security Testing (DAST) tools. SAST tools instead analyze static source code or binaries without executing the application, IAST tools combine code instrumentation with runtime analysis, and SCA tools focus on identifying vulnerable third-party/open-source dependencies rather than scanning application behavior.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!