A county security lead wants only automated DAST and no manual web testing for a civic portal. What should the tester explain?
Select an answer to reveal the explanation.
Short Explanation
Scanners are great smoke detectors — they are not fire inspectors walking every hallway. Automated DAST finds a lot, but authorization and business-logic gaps still need a human poking the workflows. Buying more threads does not replace that judgment.
Full Explanation
When a county security lead wants only automated DAST and no manual web testing for a civic portal, the tester should explain coverage limits: scanners excel at certain injection and misconfiguration classes but routinely miss nuanced authorization, multi-step business logic, and role-boundary issues that require human judgment.
Claiming DAST already proves session fixation and every workflow flaw without human review overstates tool capability. Calling manual testing obsolete after buying a scanner license confuses procurement with assurance. Increasing scanner thread count does not deliver CPTS-depth methodology coverage.
Exam caveat: automation is valuable inside a program; it is complementary evidence, not a full substitute for authorized manual assessment of civic apps.
Operational check: map critical resident workflows (apply, pay, renew), show which steps automation cannot meaningfully authorize-test, and propose a blended plan that keeps DAST while adding scoped manual authorization and logic review. Document residual risk if leadership insists on scanner-only delivery. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services.