CISSP Security Assessment and Testing Practice Question
A company wants to ensure its internal web application is free from security flaws during development. Which testing approach analyzes source code without executing the program?
⚠ Common exam trap
CISSP often tests the SAST vs DAST vs IAST vs RASP taxonomy — candidates pick DAST because it sounds like 'testing the app,' forgetting that SAST is the only one that analyzes source code without executing it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SAST
SAST (Static Application Security Testing) analyzes source code, bytecode, or binaries without executing the program, which is exactly what the question describes. It is integrated into the IDE or CI/CD pipeline to catch flaws like SQL injection, XSS, and hardcoded secrets early in the SDLC, shifting security left.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IAST
Why it's wrong here
IAST (Interactive Application Security Testing) is a hybrid analysis method that requires the application to be running and actively exercised, instrumenting it to observe internal behavior and data flow. While it offers deep insights by combining static and dynamic analysis techniques, it is not suitable for identifying vulnerabilities purely from static code analysis before any execution or comprehensive testing.
- ✗
RASP
Why it's wrong here
RASP (Runtime Application Self-Protection) functions as a security control embedded within the application itself, actively monitoring and blocking attacks in real-time during production. It is a defensive mechanism designed to protect against exploitation of vulnerabilities, rather than a testing tool designed to proactively discover vulnerabilities in the source code before deployment.
- ✗
DAST
Why it's wrong here
DAST (Dynamic Application Security Testing) scans a running application from the outside, simulating attacks to identify vulnerabilities visible at the application's external interfaces. While effective for finding runtime issues and configuration flaws, it does not analyze the underlying source code directly and requires a fully deployed, executable application to perform its tests.
- ✓
SAST
Why this is correct
SAST (Static Application Security Testing) directly examines the application's source code, bytecode, or binary code without executing it, identifying potential security vulnerabilities like SQL injection or cross-site scripting. This "white-box" approach is ideal for finding flaws early in the development lifecycle, before the application is even compiled or deployed, making it highly effective for proactive security.
Go deeper
Related to this question
Learn chapter
Software Development Security
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
SDLC
The Software Development Life Cycle (SDLC) is a structured process used by IT teams to plan, create, test, and deploy software in a reliable and organized way.
About these practice questions
Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.