CISSP Software Development Security Practice Question
Which type of security testing involves analyzing source code for vulnerabilities without executing the code?
⚠ Common exam trap
Many exam-takers confuse SAST with DAST because both are 'security testing' acronyms, but the key differentiator is that SAST analyzes code without execution (static), while DAST requires a running application (dynamic).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SAST
SAST (Static Application Security Testing) analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. It operates by scanning the codebase for patterns known to be insecure (e.g., SQL injection via string concatenation) using techniques like data flow analysis, taint tracking, and pattern matching, all performed at rest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SAST
Why this is correct
SAST (Static Application Security Testing) is a white-box testing methodology that directly analyzes an application's source code, bytecode, or binary code for security vulnerabilities without actually executing the program. It identifies potential flaws such as SQL injection, cross-site scripting (XSS), buffer overflows, and insecure direct object references by examining code patterns and data flows. This static analysis occurs early in the Software Development Life Cycle (SDLC), allowing developers to fix issues before deployment.
- ✗
Penetration testing
Why it's wrong here
Penetration testing involves simulating real-world attacks against a running application or system to identify exploitable vulnerabilities. Unlike source code analysis, it operates on the deployed application from an attacker's perspective, without direct access to the underlying source code. While it can uncover critical weaknesses, its primary focus is on the system's external attack surface, configuration, and operational security, not an internal code review.
- ✗
IAST
Why it's wrong here
IAST (Interactive Application Security Testing) is a hybrid application security testing approach that combines elements of static and dynamic analysis by instrumenting the application during runtime. It requires the application to be executing to monitor its behavior, data flow, and interactions from within. While IAST provides detailed insights into code execution paths and vulnerability locations, it does not solely analyze source code without execution, making it distinct from pure static analysis.
- ✗
DAST
Why it's wrong here
DAST (Dynamic Application Security Testing) is a black-box testing method that analyzes a running application from the outside, simulating an attacker's perspective without any knowledge of the internal source code or architecture. It identifies vulnerabilities by actively sending various inputs to the application and observing its responses, such as identifying injection flaws or misconfigurations. DAST explicitly does not involve analyzing the application's source code directly; it interacts with the application through its exposed interfaces.
Go deeper
Related to this question
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.