CISSP Security Assessment and Testing Practice Question
An organization wants to test its web application for vulnerabilities by running the application and probing it with malicious inputs. Which tool is BEST suited for this purpose?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
OWASP ZAP
DAST tools like OWASP ZAP and Burp Suite probe running applications to find vulnerabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
OWASP ZAP
Why this is correct
OWASP ZAP is a leading open-source Dynamic Application Security Testing (DAST) tool specifically designed to find vulnerabilities in running web applications. It actively proxies HTTP/S traffic, allowing it to scan for common web vulnerabilities like SQL injection, Cross-Site Scripting (XSS), and broken authentication by interacting with the application as a real user would. This makes it ideal for identifying security flaws that manifest at runtime, after the application has been deployed.
- ✗
Checkmarx
Why it's wrong here
Checkmarx is a prominent Static Application Security Testing (SAST) solution, which analyzes an application's source code, bytecode, or binary code without executing it. Its primary function is to identify potential security vulnerabilities and coding flaws early in the Software Development Life Cycle (SDLC), such as insecure coding practices or hardcoded credentials. While crucial for proactive security, SAST tools like Checkmarx do not detect runtime configuration issues or vulnerabilities that only emerge during application execution.
- ✗
SonarQube
Why it's wrong here
SonarQube primarily functions as a Static Application Security Testing (SAST) tool, focusing on continuous code quality and security analysis by inspecting source code. It identifies code smells, bugs, and security vulnerabilities like injection flaws or insecure deserialization through static analysis rules. However, SonarQube, like other SAST tools, cannot detect runtime vulnerabilities, configuration errors, or issues that arise from the interaction between different components in a live environment, which are typically found by dynamic testing.
- ✗
Veracode
Why it's wrong here
Veracode offers a comprehensive application security platform that includes both Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST), along with Software Composition Analysis (SCA) and Interactive Application Security Testing (IAST). While it provides DAST capabilities, Veracode is often recognized for its robust SAST offerings and its enterprise-grade, cloud-native approach to application security. For an organization specifically looking to test a *running* web application for runtime vulnerabilities, a dedicated DAST tool like OWASP ZAP is often a more direct and specialized choice.
Go deeper
Related to this question
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.