CS0-003 Vulnerability Management Practice Question
A security analyst is using a DAST tool to test a web application. Which of the following vulnerabilities would the tool most likely identify?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SQL injection
DAST tools interact with the running application and can detect vulnerabilities like SQL injection by sending malicious inputs and observing responses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hardcoded credentials in source code
Why it's wrong here
Dynamic Application Security Testing (DAST) operates on a running application from the outside-in without access to the underlying codebase. Detecting hardcoded credentials within source files requires Static Application Security Testing (SAST) or manual code review, which inspects the static text of the application repository.
- ✓
SQL injection
Why this is correct
DAST tools excel at identifying input validation flaws like SQL injection by actively sending malicious payloads to application entry points and analyzing the HTTP responses. If the application returns database error messages or exhibits unexpected behavior, the tool flags the vulnerability in real-time.
- ✗
Outdated library versions
Why it's wrong here
Identifying outdated third-party libraries and dependencies is the primary function of Software Composition Analysis (SCA) tools. While DAST might occasionally infer a version from a banner, it cannot comprehensively inventory or analyze the application's internal dependency tree.
- ✗
Insecure cryptographic algorithms in configuration
Why it's wrong here
Configuration files are static assets residing on the server backend, which are inaccessible to a black-box DAST scanner. Detecting weak cryptographic algorithms or misconfigured settings within these files requires static configuration analysis, infrastructure-as-code scanning, or local compliance audits.
Go deeper
Related to this question
Learn chapter
Privileged Access Management and PAM Tools
Key term
DAST
DAST (Dynamic Application Security Testing) is a security testing method that finds vulnerabilities in running web applications by simulating real attacks from the outside.
Key term
SQL injection
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries an application makes to its database, often to read, modify, or destroy data.
About these practice questions
This CS0-004 question is part of Courseiva's 701-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.