CISSP Software Development Security Practice Question
A security team is planning to integrate security testing into the software development lifecycle. They want to identify vulnerabilities early and often. Which TWO of the following testing methods should be implemented during the development phase (before deployment) to catch code-level vulnerabilities?
⚠ Common exam trap
CISSP often tests the phase confusion between SAST/IAST (development-time, code-level) and DAST/pen testing/vulnerability scanning (deployment-time, runtime or infrastructure), so candidates must map each tool to the correct SDLC phase.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Interactive Application Security Testing (IAST)
Option A, Interactive Application Security Testing (IAST), is correct because it instruments the running application (often via agents during automated tests) to analyze code execution in real time, detecting code-level vulnerabilities such as injection flaws early in the development phase before deployment. Option D, Static Application Security Testing (SAST), is correct because it performs white-box analysis of source code, bytecode, or binaries without executing the program, allowing developers to find flaws like SQL injection or hardcoded secrets directly in the code during development. Penetration testing (B) is typically conducted against a deployed, running system and simulates real-world attacks, so it occurs later than the development phase. Vulnerability scanning (C) identifies known weaknesses in deployed hosts, services, and configurations rather than code-level defects during development. Dynamic Application Security Testing (E) tests a running application from the outside (black-box) and is generally performed after deployment or in a staging environment, not as an early code-level check.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Interactive Application Security Testing (IAST)
Why this is correct
IAST is a modern security testing method that instruments the application code and observes its behavior from within during automated or manual functional tests. It provides real-time analysis of application interactions, identifying vulnerabilities with high accuracy by understanding both code execution and data flow. This integration into existing testing processes makes it highly effective for finding flaws early in the development lifecycle.
- ✗
Penetration testing
Why it's wrong here
Penetration testing involves authorized simulated attacks on a system to identify exploitable vulnerabilities and assess the overall security posture. While crucial for validating defenses, it is typically a resource-intensive, manual process performed at later stages of the development lifecycle or on deployed systems. Its nature makes it unsuitable for continuous integration into early development and testing phases.
- ✗
Vulnerability scanning
Why it's wrong here
Vulnerability scanning systematically identifies known security weaknesses in networks, servers, and applications by comparing system configurations and installed software against a database of known vulnerabilities. While important for overall security posture, it primarily focuses on infrastructure and common software flaws, rather than deep analysis of custom application code during its development. It's generally an external, post-development assessment.
- ✓
Static Application Security Testing (SAST)
Why this is correct
SAST analyzes an application's source code, bytecode, or binary code for security vulnerabilities without actually executing the program. It identifies potential flaws such as SQL injection, cross-site scripting, and buffer overflows directly within the code. This method is highly effective for integration into the early stages of the Software Development Life Cycle (SDLC), allowing developers to fix issues proactively.
- ✗
Dynamic Application Security Testing (DAST)
Why it's wrong here
DAST examines a running application from the outside, simulating an attacker's perspective by sending various inputs and observing the application's responses. It can identify runtime vulnerabilities like authentication flaws or configuration errors. However, DAST requires a fully functional and deployed application instance, making it more suitable for later stages of the SDLC, such as quality assurance or pre-production environments, rather than continuous integration during early development.
Go deeper
Related to this question
Learn chapter
Security Assessment and Testing
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
About these practice questions
Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.