CAS-004 Security Architecture Practice Question
During a secure SDLC, a development team wants to identify vulnerabilities in running code. Which type of testing should be performed?
⚠ Common exam trap
CAS-005 often tests the SAST vs. DAST vs. IAST distinction — candidates may pick SAST because it is 'code testing,' but the key phrase 'running code' signals DAST, which tests the live application.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DAST
DAST (Dynamic Application Security Testing) tests running applications from the outside by simulating attacks against a live deployment, which is exactly what is needed to identify vulnerabilities in running code. It analyzes the application in its deployed state, including runtime configuration and environment-specific issues.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IAST
Why it's wrong here
IAST instruments an agent inside a running application, but it requires execution of test cases and typically needs a DAST scanner or test suite driving the app; it does not scan an already-running production instance standalone. It is correct when instrumented runtime testing during QA is feasible.
- ✗
SAST
Why it's wrong here
SAST analyses source code or bytecode at rest, before execution, so it cannot observe runtime behaviour or live data flows in running code. It is tempting because SAST catches flaws early in the SDLC, and it would be the right choice when reviewing static source in a code repository before build.
- ✓
DAST
Why this is correct
DAST tests a running application from the outside, exercising it as an attacker would and observing responses. This detects vulnerabilities in executing code, including runtime and configuration flaws that static analysis of source cannot reveal, matching the team's requirement.
- ✗
RASP
Why it's wrong here
RASP instruments a running application to detect and block attacks at runtime, so it observes live execution rather than scanning code for vulnerabilities during development. RASP is correct for runtime protection in production, not for identifying flaws in code under test.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.