CAS-004 Security Architecture Practice Question
A financial institution is implementing a secure software development lifecycle (SSDLC) for a new web application that will handle sensitive transactions. The security architect must ensure that application security testing is integrated into the development process. Which THREE testing techniques should be used to identify vulnerabilities early and throughout the lifecycle? (Choose THREE.)
⚠ Common exam trap
The trap is treating RASP as a testing tool because it shares the 'application security' label — candidates must distinguish runtime protection (RASP) from vulnerability discovery techniques (SAST/DAST/IAST).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Static Application Security Testing (SAST)
SAST (A) is correct because it analyzes source code, bytecode, or binaries without executing the application, allowing developers to find flaws such as injection patterns, insecure coding, and hardcoded secrets early in the SSDLC, even in CI pipelines. IAST (C) is correct because it instruments the running application and combines static and dynamic analysis to detect vulnerabilities during functional testing with high accuracy and code-level context, fitting continuous integration. DAST (D) is correct because it tests the deployed application from the outside by sending crafted requests to find runtime and configuration issues such as SQL injection, XSS, and authentication flaws in the running web app. RASP (B) is not a testing technique but a runtime protection mechanism that detects and blocks attacks in production, so it does not identify vulnerabilities early in development. Threat modeling (E) is a design-phase risk analysis activity, not an application security testing technique, so it does not satisfy the requirement for testing throughout the lifecycle.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Static Application Security Testing (SAST)
Why this is correct
SAST analyses source code without executing it, flagging injection flaws, insecure patterns and coding errors during development. This satisfies the SSDLC requirement to identify vulnerabilities early, before code reaches testing or production, reducing remediation cost for the sensitive-transaction application.
- ✗
Runtime Application Self-Protection (RASP)
Why it's wrong here
RASP instruments the running application to detect and block attacks at execution time, which is production defence rather than a testing technique identifying vulnerabilities during development. It is tempting because it does surface runtime weaknesses, and it would be correct when protecting a deployed application in production.
- ✓
Interactive Application Security Testing (IAST)
Why this is correct
IAST instruments the running application and observes code execution from within, correlating runtime behaviour with source lines to report precise flaws with low false positives. This satisfies the SSDLC requirement for testing throughout the lifecycle, complementing static and dynamic techniques during QA.
- ✓
Dynamic Application Security Testing (DAST)
Why this is correct
DAST probes the deployed application from outside, exercising inputs to expose runtime vulnerabilities such as authentication bypass, injection and misconfiguration. This satisfies the SSDLC requirement for testing throughout the lifecycle by validating the running web application before release.
- ✗
Threat modeling
Why it's wrong here
Threat modelling is a design-time analysis technique that enumerates threats and mitigations; it does not execute code or scan artefacts, so it cannot identify vulnerabilities in built components. It is tempting because it is performed early, and it would be correct when the goal is architectural risk assessment before coding begins.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 973-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.