CISSP Security Assessment and Testing Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Dynamic Application Security Testing (DAST)

  Why it's wrong here

  Dynamic Application Security Testing (DAST) operates by executing the compiled application and simulating attacks against its running instance, much like an external attacker. It observes the application's behavior and responses to identify vulnerabilities such as injection flaws or cross-site scripting. However, DAST is typically performed later in the development lifecycle, after the application has been deployed to a test or production environment, making it unsuitable for an initial code-level security review.

• ✗

  Interactive Application Security Testing (IAST)

  Why it's wrong here

  Interactive Application Security Testing (IAST) combines elements of both static and dynamic analysis by instrumenting the application at runtime. It monitors application execution from within, observing data flow and code execution paths to pinpoint vulnerabilities more accurately than DAST, while also providing context from the source code. Despite its hybrid nature, IAST still necessitates a running application, often within a quality assurance or testing phase, which means it's not primarily a tool for reviewing static source code directly.

• ✓

  Static Application Security Testing (SAST)

  Why this is correct

  Static Application Security Testing (SAST) directly analyzes an application's source code, bytecode, or binary code without actually executing the program. This method allows security teams to identify potential vulnerabilities, such as buffer overflows, SQL injection flaws, or insecure cryptographic practices, early in the Software Development Life Cycle (SDLC). SAST is ideal for reviewing application security during development, enabling developers to fix issues before the application is even compiled or deployed.

• ✗

  Runtime Application Self-Protection (RASP)

  Why it's wrong here

  Runtime Application Self-Protection (RASP) is a security technology that integrates directly into an application's runtime environment to detect and prevent attacks in real-time. It acts as a protective shield, analyzing incoming requests and application behavior to block malicious activities before they can exploit vulnerabilities. RASP is a defensive measure, not a testing or review tool, and therefore does not assist a security team in proactively reviewing the underlying code for vulnerabilities during a development phase.

Go deeper

Related to this question