CISSP Software Development Security Practice Question
A security team is planning to integrate security testing into the software development lifecycle. They want to identify vulnerabilities early and often. Which TWO of the following testing methods should be implemented during the development phase (before deployment) to catch code-level vulnerabilities?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Interactive Application Security Testing (IAST)
SAST (Static Application Security Testing) analyzes source code for vulnerabilities without executing it. IAST (Interactive Application Security Testing) combines SAST and DAST by instrumenting the application and analyzing runtime behavior. Both are suitable for development phase. DAST requires a running application, and penetration testing is usually done later.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Interactive Application Security Testing (IAST)
Why this is correct
IAST is a modern security testing method that instruments the application code and observes its behavior from within during automated or manual functional tests. It provides real-time analysis of application interactions, identifying vulnerabilities with high accuracy by understanding both code execution and data flow. This integration into existing testing processes makes it highly effective for finding flaws early in the development lifecycle.
- ✗
Penetration testing
Why it's wrong here
Penetration testing involves authorized simulated attacks on a system to identify exploitable vulnerabilities and assess the overall security posture. While crucial for validating defenses, it is typically a resource-intensive, manual process performed at later stages of the development lifecycle or on deployed systems. Its nature makes it unsuitable for continuous integration into early development and testing phases.
- ✗
Vulnerability scanning
Why it's wrong here
Vulnerability scanning systematically identifies known security weaknesses in networks, servers, and applications by comparing system configurations and installed software against a database of known vulnerabilities. While important for overall security posture, it primarily focuses on infrastructure and common software flaws, rather than deep analysis of custom application code during its development. It's generally an external, post-development assessment.
- ✓
Static Application Security Testing (SAST)
Why this is correct
SAST analyzes an application's source code, bytecode, or binary code for security vulnerabilities without actually executing the program. It identifies potential flaws such as SQL injection, cross-site scripting, and buffer overflows directly within the code. This method is highly effective for integration into the early stages of the Software Development Life Cycle (SDLC), allowing developers to fix issues proactively.
- ✗
Dynamic Application Security Testing (DAST)
Why it's wrong here
DAST examines a running application from the outside, simulating an attacker's perspective by sending various inputs and observing the application's responses. It can identify runtime vulnerabilities like authentication flaws or configuration errors. However, DAST requires a fully functional and deployed application instance, making it more suitable for later stages of the SDLC, such as quality assurance or pre-production environments, rather than continuous integration during early development.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Penetration testing
Penetration testing is a simulated cyberattack on a computer system, network, or application to find security weaknesses before real attackers can exploit them.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.