What strategies reduce DAST scan time while maintaining security coverage?

WHAT THIS TESTS: This question evaluates whether you understand that security scanning is a systems-design problem, not just a tooling problem. The interviewer wants to see if you can optimize feedback loops in CI/CD without treating security as a binary on-off switch. Specifically, they are looking for knowledge of DAST mechanics, such as crawl-and-audit phases, authentication overhead, and scope explosion, plus your ability to layer controls so that speed and coverage coexist.

A GOOD ANSWER COVERS: A strong response walks through four strategies in order of impact. First, incremental or delta scanning: configure the DAST tool to target only changed endpoints or newly built containers rather than the entire application surface every run. Second, parallelization and infrastructure scaling: shard the scan across multiple workers, use larger CI runners, or split by functional domain so crawl and audit phases happen concurrently. Third, scope reduction and session optimization: tighten URL allowlists, exclude static assets, and reuse authenticated sessions to eliminate redundant login crawls. Fourth, shift-left augmentation: admit that DAST is inherently slow and complement it with SAST or IAST in the fast pipeline while keeping a full DAST run in a slower nightly or staging gate. You should also mention risk-based tuning, such as lowering the audit depth for internal APIs while keeping maximum depth for public-facing endpoints.

COMMON WRONG ANSWERS: The biggest red flag is proposing to move DAST to nightly without explaining how developers will get immediate feedback or how you will block releases on critical findings. Another weak answer is blindly shrinking the scan scope without considering whether you are excluding sensitive endpoints like admin panels or checkout flows. Suggesting to disable specific high-sensitivity checks to save time is also problematic unless you explicitly discuss compensating controls or risk acceptance. Finally, ignoring authentication setup as a bottleneck shows inexperience with real DAST deployments.

LIKELY FOLLOW-UPS: The interviewer may ask how you would identify which endpoints changed between builds, how you handle authenticated scanning statefully, or what metrics you would use to prove coverage did not regress. They might also probe whether you would gate merges on DAST results, how you prioritize findings when speed increases false negatives, or how you integrate IAST agents without degrading application performance.

ONE CONCRETE EXAMPLE: Suppose a microservices pipeline runs a full OWASP ZAP scan against fifty services. Instead of one hour, you map OpenAPI specs from the PR to generate an importable URL list, cutting the crawl phase to only two changed services. You run two ZAP containers in parallel via CI matrix jobs and reuse a pre-generated authentication cookie jar. The per-PR scan drops to eight minutes. A full baseline scan still runs nightly against production mirrors, and SAST catches injection flaws in the fast path so developers are not waiting on DAST for every commit.