easyMultiple ChoiceObjective-mapped
CS0-003 Practice Question: A DAST scan cannot reach authenticated pages of a…
A DAST scan cannot reach authenticated pages of a web application and reports only public content findings. What should be configured? For control selection, Which control best addresses the stated weakness without hiding risk?
⚠ Common exam trap
CompTIA often tests the misconception that a DAST scanner's lack of findings on public pages implies the entire application is secure, when in fact the scanner never accessed the authenticated areas, so the risk remains hidden.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authenticated scanning with a test account and session handling
DAST scanners require authenticated access to crawl and test pages behind login forms. By configuring authenticated scanning with a test account and session handling (e.g., using cookies or OAuth tokens), the scanner can traverse protected routes and detect vulnerabilities such as SQL injection or XSS on authenticated pages. This directly addresses the stated weakness without masking risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable all application authentication
Why it's wrong here
Disabling authentication fundamentally alters the application's security architecture, making the scan results unrepresentative of the actual production environment's vulnerabilities. This approach would test a completely different system configuration, rendering any findings irrelevant to the real-world security posture. Furthermore, removing authentication introduces significant security risks to the testing environment itself, potentially exposing sensitive data or functionality during the scan.
- ✗
Treat absence of findings as proof of security
Why it's wrong here
Assuming an application is secure simply because a DAST scan found no vulnerabilities on unreached, authenticated pages is a critical logical fallacy. The DAST tool cannot report findings on functionality it never accessed, creating a false sense of security regarding the application's true attack surface. This approach ignores the significant risk posed by untested, protected areas where many critical vulnerabilities often reside, providing an incomplete and misleading security assessment.
- ✗
Reduce the scan to only the landing page
Why it's wrong here
Reducing the DAST scan scope to only the landing page directly contradicts the objective of testing authenticated functionality. This action would severely limit the attack surface coverage, deliberately excluding the very protected areas that need to be assessed for vulnerabilities. Consequently, critical business logic and sensitive data handling behind login screens would remain untested, leaving significant security gaps unaddressed and providing an incomplete security posture.
- ✓
Authenticated scanning with a test account and session handling
Why this is correct
This is the correct approach because DAST tools can be configured to simulate a legitimate user's interaction by logging in with a dedicated test account. By properly managing session tokens or cookies, the scanner gains access to protected areas of the application, allowing it to thoroughly test functionality behind authentication. This method ensures comprehensive coverage of the entire application, including pages requiring login, thereby identifying vulnerabilities that would otherwise remain hidden.
Go deeper
Related to this question
Learn chapter
Vulnerability Scanning Techniques
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
SQL injection
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries an application makes to its database, often to read, modify, or destroy data.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 236 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.