easyMultiple ChoiceObjective-mapped
CCSP Practice Question: Which security testing approach is most effective…
Which security testing approach is most effective at identifying vulnerabilities early in the cloud software development lifecycle (SDLC) by analyzing source code without executing the application?
⚠ Common exam trap
ISC2 often tests the distinction between SAST and DAST by framing the question around 'early in the SDLC' and 'without executing the application'—candidates mistakenly choose DAST because it is a common security test, but DAST requires a running application and is performed later in the lifecycle.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Static Application Security Testing (SAST)
Static Application Security Testing (SAST) is the correct approach because it analyzes source code, bytecode, or binary code without executing the application, making it ideal for identifying vulnerabilities early in the SDLC (shift-left). Unlike dynamic or runtime tools, SAST scans the codebase statically, catching issues like SQL injection, buffer overflows, and insecure cryptographic implementations before compilation or deployment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Interactive Application Security Testing (IAST)
Why it's wrong here
IAST runs alongside the application, requiring execution.
- ✓
Static Application Security Testing (SAST)
Why this is correct
SAST analyzes source code without execution, fitting the shift-left model.
- ✗
Runtime Application Self-Protection (RASP)
Why it's wrong here
RASP protects applications at runtime, not during development.
- ✗
Dynamic Application Security Testing (DAST)
Why it's wrong here
DAST tests the running application, so it is performed later in the SDLC.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.