CISSP Security Assessment and Testing Practice Question
An organization wants to ensure that its web application is secure by analyzing the source code for vulnerabilities without executing the code. Which type of testing is most appropriate?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Static Application Security Testing (SAST)
SAST (Static Application Security Testing) analyzes source code at rest, without executing it, making it ideal for finding vulnerabilities early in the development lifecycle.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Interactive Application Security Testing (IAST)
Why it's wrong here
Interactive Application Security Testing (IAST) operates by instrumenting the application at runtime, monitoring its execution and data flow from within. While it provides detailed insights into vulnerabilities by observing how code interacts with user input and backend systems, it does not perform a direct, static analysis of the source code itself. Its primary function is to identify vulnerabilities during active testing, not pre-execution code review.
- ✗
Dynamic Application Security Testing (DAST)
Why it's wrong here
Dynamic Application Security Testing (DAST) performs black-box testing against a running application, simulating external attacks to find vulnerabilities without access to the internal source code or architecture. It interacts with the application through its exposed interfaces, such as HTTP requests, to identify issues like SQL injection or cross-site scripting. Therefore, DAST is unsuitable for directly analyzing the source code for inherent flaws before deployment.
- ✗
Runtime Application Self-Protection (RASP)
Why it's wrong here
Runtime Application Self-Protection (RASP) is a security technology designed to protect applications from attacks in real-time by actively monitoring and blocking malicious inputs or behaviors during execution. It integrates directly into the application runtime environment, providing self-protection capabilities rather than identifying vulnerabilities through code analysis. RASP acts as a defensive shield, not a static testing tool for pre-deployment code review.
- ✓
Static Application Security Testing (SAST)
Why this is correct
Static Application Security Testing (SAST) directly analyzes an application's source code, bytecode, or binary code for security vulnerabilities without executing the program. It identifies potential flaws such as buffer overflows, SQL injection vulnerabilities, and insecure coding practices by examining the code structure and data flow paths. This 'shift-left' approach allows developers to find and fix security defects early in the software development lifecycle, before deployment.
Go deeper
Related to this question
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.