CISSP Security Assessment and Testing Practice Question
A developer uses a tool that analyzes source code for potential security flaws without executing the program. This is an example of:
⚠ Common exam trap
Many candidates confuse SAST with DAST because both are application security testing types, but the key differentiator is execution: SAST is static (no execution) while DAST is dynamic (requires execution).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SAST
SAST (Static Application Security Testing) analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. This matches the description of a tool that inspects code statically, making D the correct answer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DAST
Why it's wrong here
DAST (Dynamic Application Security Testing) performs security testing on a running application by simulating external attacks, much like a malicious user would. It interacts with the application's exposed interfaces, such as HTTP/HTTPS requests, to identify vulnerabilities without requiring access to the underlying source code. This method focuses on observable behaviors and responses, making it unsuitable for direct source code analysis.
- ✗
IAST
Why it's wrong here
IAST (Interactive Application Security Testing) operates by instrumenting the application at runtime, typically through agents deployed within the application server or environment. This allows it to observe application behavior, data flow, and execution paths from an internal perspective while the application is actively being used or tested. Although it provides detailed insights into vulnerabilities, it still necessitates the application's execution, which differs from a purely static source code analysis.
- ✗
RASP
Why it's wrong here
RASP (Runtime Application Self-Protection) is a security technology designed to protect applications from attacks in real-time by monitoring their execution from within. It actively detects and blocks malicious inputs or behaviors, acting as a self-protection mechanism rather than a testing tool. While it provides runtime protection, RASP does not analyze source code for vulnerabilities prior to execution; its primary function is defense against active threats.
- ✓
SAST
Why this is correct
SAST (Static Application Security Testing) directly examines an application's source code, bytecode, or binary code without executing it, making it a 'white-box' testing method. It identifies potential vulnerabilities such as buffer overflows, SQL injection flaws, or insecure coding practices by analyzing the code's structure, data flow, and control flow statically. This approach is ideal for developers to find and fix security flaws early in the Software Development Life Cycle (SDLC) before deployment.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.