CRISC IT Risk Identification Practice Question
A financial services firm is assessing vulnerabilities in its web application. The team wants to identify application-level vulnerabilities that could be exploited. Which TWO vulnerability identification techniques should be prioritized for this purpose?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SAST (Static Application Security Testing)
SAST (Static Application Security Testing) analyzes source code for vulnerabilities, and DAST (Dynamic Application Security Testing) tests running applications. IAST combines both but is less common. CVE database and CIS Benchmarks are asset- and configuration-focused, not application-specific.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IAST (Interactive Application Security Testing)
Why it's wrong here
IAST is a hybrid approach but less commonly prioritized over SAST and DAST.
- ✗
CVE database review
Why it's wrong here
CVE database is used for known vulnerabilities in software versions, not specific to application code vulnerabilities.
- ✗
CIS Benchmarks comparison
Why it's wrong here
CIS Benchmarks are configuration hardening guidelines, not for identifying application vulnerabilities.
- ✓
SAST (Static Application Security Testing)
Why this is correct
SAST analyzes source code for vulnerabilities early in the development lifecycle, making it effective for application vulnerability identification.
- ✓
DAST (Dynamic Application Security Testing)
Why this is correct
DAST tests the running application for vulnerabilities from an external perspective, complementing SAST.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.