CRISC IT Risk Identification Practice Question
During a vulnerability assessment, a risk practitioner identifies that a web application is vulnerable to SQL injection, which is listed in the OWASP Top 10. Which type of vulnerability identification technique MOST likely discovered this issue?
⚠ Common exam trap
CRISC often tests the misconception that SAST is the primary method for finding injection flaws because it examines code, but the key differentiator is that DAST tests running applications and is more likely to discover exploitable SQL injection during a vulnerability assessment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DAST (Dynamic Application Security Testing)
DAST (Dynamic Application Security Testing) is correct because it tests a running application from the outside by simulating attacks, such as injecting malicious SQL payloads into input fields, which directly reveals SQL injection vulnerabilities. SQL injection is a runtime flaw that manifests when untrusted input is improperly handled by the application and database, so it is most reliably discovered through dynamic testing. SAST, by contrast, analyzes source code statically and may miss or misidentify injection flaws due to complex data flows. Thus, DAST is the technique that most likely discovered this issue during a vulnerability assessment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SAST (Static Application Security Testing)
Why it's wrong here
SAST analyses source code without executing it, so it cannot observe injection payloads reaching a live database through HTTP input. It is tempting because it flags OWASP Top 10 patterns in code, and would be correct for reviewing source before deployment, not for confirming runtime SQL injection.
- ✗
CIS Benchmarks comparison
Why it's wrong here
CIS Benchmarks compare host and application configuration against hardened baselines, so they flag weak settings rather than injection flaws in bespoke code. They are tempting because they systematically identify misconfigurations; they would be correct when assessing server or OS hardening compliance, not application input-validation defects.
- ✓
DAST (Dynamic Application Security Testing)
Why this is correct
DAST tests a running application from the outside, sending crafted inputs and observing responses, so it detects SQL injection through runtime behaviour. It satisfies the scenario by identifying the exploitable injection flaw in the deployed web application, matching the OWASP Top 10 entry.
- ✗
DISA STIG scanning
Why it's wrong here
DISA STIG scanning checks configuration compliance against mandated hardening baselines, so it detects insecure settings rather than unsanitised SQL queries in application code. It is tempting because STIGs are authoritative and repeatable; they would be the right choice when verifying DoD-style system hardening, not discovering injection flaws.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.