CISSP Security Assessment and Testing Practice Question
A security team is selecting tools for code review. Which THREE of the following are characteristics of Static Application Security Testing (SAST) tools?
⚠ Common exam trap
Watch out — candidates often confuse SAST with DAST: candidates often select 'analyze while running' (Option D) because they think 'static' means 'after deployment' or 'during runtime', but SAST is static (non-executing) and DAST is dynamic (executing).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
They require access to the source code
SAST tools analyze source code, bytecode, or binary code without executing the application. They require access to the source code to perform static analysis, scanning for security flaws such as injection vulnerabilities, buffer overflows, and insecure cryptographic implementations. This allows developers to identify and fix vulnerabilities early in the development lifecycle, before the code is compiled or deployed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
They require access to the source code
Why this is correct
Static Application Security Testing (SAST) tools operate by analyzing an application's source code, bytecode, or binary code without actually executing the program. This direct access to the underlying code allows SAST to identify potential vulnerabilities such as buffer overflows, SQL injection flaws, and cross-site scripting (XSS) by examining code patterns and data flow paths. Without this direct access, SAST cannot perform its core function of static analysis, making it a fundamental requirement for its operation.
- ✗
They are typically used after deployment
Why it's wrong here
SAST tools are designed to be integrated into the early stages of the Software Development Lifecycle (SDLC), specifically during the coding and testing phases, well before an application is deployed to production. Their primary purpose is to identify security flaws in the source code itself, allowing developers to remediate issues proactively and cost-effectively. Tools like Dynamic Application Security Testing (DAST) or penetration testing are typically employed after deployment to assess the running application's behavior and exposed interfaces.
- ✓
They can be integrated into the CI/CD pipeline
Why this is correct
Integrating SAST tools into the Continuous Integration/Continuous Delivery (CI/CD) pipeline is a common practice in modern DevOps environments. This integration allows for automated security scans to be triggered with every code commit or build, providing immediate feedback to developers on newly introduced vulnerabilities. By automating these checks, organizations can enforce security policies earlier and more consistently throughout the development process, accelerating secure software delivery and reducing manual overhead.
- ✗
They analyze the application while it is running
Why it's wrong here
SAST tools perform static analysis, meaning they examine the application's code without executing it. This contrasts sharply with dynamic analysis techniques, such as Dynamic Application Security Testing (DAST) or Interactive Application Security Testing (IAST), which actively interact with a running application to observe its behavior and identify vulnerabilities. SAST's strength lies in its ability to find issues in non-executable code paths and provide precise line-of-code remediation guidance, which is not possible with runtime analysis alone.
- ✓
They identify vulnerabilities early in the software development lifecycle
Why this is correct
A primary advantage of SAST is its ability to identify security vulnerabilities during the initial phases of the Software Development Lifecycle (SDLC), often referred to as "shifting left." By scanning source code as it is being written or compiled, SAST enables developers to detect and fix flaws much earlier than if they waited for later testing or deployment. This early detection significantly reduces the cost and effort associated with remediation, as vulnerabilities become exponentially more expensive to fix the later they are discovered in the development cycle.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.