easyMultiple Choice
CCSP Practice Question: Which security testing approach is most effective…
Which security testing approach is most effective at identifying vulnerabilities early in the cloud software development lifecycle (SDLC) by analyzing source code without executing the application?
⚠ Common exam trap
ISC2 often tests the distinction between SAST and DAST by framing the question around 'early in the SDLC' and 'without executing the application'—candidates mistakenly choose DAST because it is a common security test, but DAST requires a running application and is performed later in the lifecycle.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Static Application Security Testing (SAST)
Static Application Security Testing (SAST) is the correct approach because it analyzes source code, bytecode, or binary code without executing the application, making it ideal for identifying vulnerabilities early in the SDLC (shift-left). Unlike dynamic or runtime tools, SAST scans the codebase statically, catching issues like SQL injection, buffer overflows, and insecure cryptographic implementations before compilation or deployment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Interactive Application Security Testing (IAST)
Why it's wrong here
IAST instruments a running application from within, so it requires execution and cannot analyse static source alone. It is tempting because it combines SAST and DAST strengths during runtime testing, but the stem demands source-code analysis without executing the application, which only SAST satisfies.
- ✓
Static Application Security Testing (SAST)
Why this is correct
Static Application Security Testing examines source code without executing it, satisfying the stem's requirement to find flaws early in the cloud SDLC. By scanning for injection, insecure dependencies and coding errors at commit time, SAST shifts detection left, before deployment. Dynamic and runtime tools need a running application, so they cannot meet the "without executing" constraint.
- ✗
Runtime Application Self-Protection (RASP)
Why it's wrong here
RASP instruments a running application to block attacks at execution time, so it cannot analyse source code before deployment. Early SDLC detection without execution requires static analysis. RASP would be correct for defending a live application against exploitation attempts in production.
- ✗
Dynamic Application Security Testing (DAST)
Why it's wrong here
DAST probes a deployed, running application from the outside, so it cannot inspect source code before execution. It is tempting because it finds runtime and configuration flaws in live cloud environments, but the stem requires early static analysis without executing the application, which SAST provides instead.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.