easyMultiple ChoiceObjective-mapped
CISSP Practice Question: A security analyst is tasked with identifying…
A security analyst is tasked with identifying vulnerabilities in a web application that is still in development. The application code is not yet stable, and frequent changes are expected. Which testing approach would be most appropriate to identify vulnerabilities without hindering the development process?
⚠ Common exam trap
Many exam-takers choose DAST (Option D) because they associate 'dynamic' with 'real-world testing,' but they overlook the critical constraint that the application is unstable and in development, making SAST the only viable option that does not require a running application.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Static application security testing (SAST)
Static Application Security Testing (SAST) is the most appropriate approach because it analyzes source code, byte code, or binary code without executing the application, making it ideal for early-stage development where code is unstable and frequently changing. SAST can be integrated into the development pipeline (e.g., as a pre-commit hook or CI/CD step) to identify vulnerabilities like SQL injection, XSS, or buffer overflows without requiring a running application or hindering the iterative development process.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Fuzz testing
Why it's wrong here
Fuzz testing involves providing invalid, unexpected, or random data as inputs to a computer program to discover software bugs and security vulnerabilities, particularly related to input validation and error handling. While effective for uncovering specific crash-inducing inputs or buffer overflows, it is not designed for comprehensive identification of all vulnerability types, such as architectural flaws, insecure configurations, or logical vulnerabilities. Therefore, it's not the primary method for a broad vulnerability assessment.
- ✗
Manual penetration testing
Why it's wrong here
Manual penetration testing involves skilled security professionals actively attempting to exploit vulnerabilities in a system, mimicking real-world attackers. While highly effective for uncovering complex, business-logic flaws and chained exploits, it is inherently resource-intensive, time-consuming, and does not scale well for frequent or automated vulnerability identification across a rapidly evolving codebase. Its sporadic nature makes it unsuitable for continuous integration environments.
- ✓
Static application security testing (SAST)
Why this is correct
Static Application Security Testing (SAST) analyzes an application's source code, bytecode, or binary code for security vulnerabilities without executing the program. This method allows for early detection of flaws during the development lifecycle, often integrated directly into the Continuous Integration/Continuous Delivery (CI/CD) pipeline. SAST tools can identify a wide range of vulnerabilities, including SQL injection, cross-site scripting, and buffer overflows, by examining code patterns and ensuring adherence to secure coding standards before deployment.
- ✗
Dynamic application security testing (DAST)
Why it's wrong here
Dynamic Application Security Testing (DAST) analyzes a running application from the outside, simulating attacks against the deployed system to identify vulnerabilities that are exploitable in a live environment. While effective for finding runtime issues, configuration errors, and authentication flaws, DAST requires a fully functional application, meaning it cannot be used in the earliest stages of development. Consequently, it may miss vulnerabilities present only in the source code or those not exposed through the application's external interfaces.
Go deeper
Related to this question
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.