CISSP Security Assessment and Testing Practice Question
An organization wants to ensure that its web application is secure by analyzing the source code for vulnerabilities without executing the code. Which type of testing is most appropriate?
⚠ Common exam trap
CISSP often tests the distinction between static (non-running code) and dynamic (running application) testing, and candidates frequently confuse IAST with SAST because both can involve code analysis, but IAST requires execution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Static Application Security Testing (SAST)
Static Application Security Testing (SAST) analyzes source code, bytecode, or binaries without executing the application, making it the only option that matches the requirement of reviewing code for vulnerabilities in a non-running state. SAST tools perform data-flow and control-flow analysis to detect issues like SQL injection, buffer overflows, and hardcoded secrets directly in the codebase. Because it operates pre-execution, it can be integrated early in the SDLC (shift-left) and pinpoint the exact file and line of a flaw.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Interactive Application Security Testing (IAST)
Why it's wrong here
Interactive Application Security Testing (IAST) operates by instrumenting the application at runtime, monitoring its execution and data flow from within. While it provides detailed insights into vulnerabilities by observing how code interacts with user input and backend systems, it does not perform a direct, static analysis of the source code itself. Its primary function is to identify vulnerabilities during active testing, not pre-execution code review.
- ✗
Dynamic Application Security Testing (DAST)
Why it's wrong here
Dynamic Application Security Testing (DAST) performs black-box testing against a running application, simulating external attacks to find vulnerabilities without access to the internal source code or architecture. It interacts with the application through its exposed interfaces, such as HTTP requests, to identify issues like SQL injection or cross-site scripting. Therefore, DAST is unsuitable for directly analyzing the source code for inherent flaws before deployment.
- ✗
Runtime Application Self-Protection (RASP)
Why it's wrong here
Runtime Application Self-Protection (RASP) is a security technology designed to protect applications from attacks in real-time by actively monitoring and blocking malicious inputs or behaviors during execution. It integrates directly into the application runtime environment, providing self-protection capabilities rather than identifying vulnerabilities through code analysis. RASP acts as a defensive shield, not a static testing tool for pre-deployment code review.
- ✓
Static Application Security Testing (SAST)
Why this is correct
Static Application Security Testing (SAST) directly analyzes an application's source code, bytecode, or binary code for security vulnerabilities without executing the program. It identifies potential flaws such as buffer overflows, SQL injection vulnerabilities, and insecure coding practices by examining the code structure and data flow paths. This 'shift-left' approach allows developers to find and fix security defects early in the software development lifecycle, before deployment.
Go deeper
Related to this question
Learn chapter
Secure Network Architecture and Components
Key term
SDLC
The Software Development Life Cycle (SDLC) is a structured process used by IT teams to plan, create, test, and deploy software in a reliable and organized way.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This CISSP question is part of Courseiva's 816-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.