CISSP Security Assessment and Testing Practice Question
A security team is reviewing application security and needs to analyze source code without executing the application. Which technique should they use?
⚠ Common exam trap
CISSP often tests the distinction between testing techniques that require execution (DAST, IAST, RASP) and those that do not (SAST), so the trap is selecting a runtime technique when the question explicitly says the application is not executed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Static Application Security Testing (SAST)
Static Application Security Testing (SAST) analyzes source code, bytecode, or binaries without executing the application, looking for vulnerabilities such as injection flaws, hardcoded secrets, and insecure patterns. Because it operates on the code itself, it can be run early in the SDLC and integrated into CI/CD pipelines. This matches the requirement to analyze source code without executing the application.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Dynamic Application Security Testing (DAST)
Why it's wrong here
Dynamic Application Security Testing (DAST) operates by executing the compiled application and simulating attacks against its running instance, much like an external attacker. It observes the application's behavior and responses to identify vulnerabilities such as injection flaws or cross-site scripting. However, DAST is typically performed later in the development lifecycle, after the application has been deployed to a test or production environment, making it unsuitable for an initial code-level security review.
- ✗
Interactive Application Security Testing (IAST)
Why it's wrong here
Interactive Application Security Testing (IAST) combines elements of both static and dynamic analysis by instrumenting the application at runtime. It monitors application execution from within, observing data flow and code execution paths to pinpoint vulnerabilities more accurately than DAST, while also providing context from the source code. Despite its hybrid nature, IAST still necessitates a running application, often within a quality assurance or testing phase, which means it's not primarily a tool for reviewing static source code directly.
- ✓
Static Application Security Testing (SAST)
Why this is correct
Static Application Security Testing (SAST) directly analyzes an application's source code, bytecode, or binary code without actually executing the program. This method allows security teams to identify potential vulnerabilities, such as buffer overflows, SQL injection flaws, or insecure cryptographic practices, early in the Software Development Life Cycle (SDLC). SAST is ideal for reviewing application security during development, enabling developers to fix issues before the application is even compiled or deployed.
- ✗
Runtime Application Self-Protection (RASP)
Why it's wrong here
Runtime Application Self-Protection (RASP) is a security technology that integrates directly into an application's runtime environment to detect and prevent attacks in real-time. It acts as a protective shield, analyzing incoming requests and application behavior to block malicious activities before they can exploit vulnerabilities. RASP is a defensive measure, not a testing or review tool, and therefore does not assist a security team in proactively reviewing the underlying code for vulnerabilities during a development phase.
Go deeper
Related to this question
Learn chapter
Security Assessment and Testing
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
SDLC
The Software Development Life Cycle (SDLC) is a structured process used by IT teams to plan, create, test, and deploy software in a reliable and organized way.
About these practice questions
Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.