CISSP Software Development Security Practice Question
Which type of testing analyzes source code for security vulnerabilities without executing the program?
⚠ Common exam trap
A common mix-up: candidates confuse SAST with DAST because both are automated security testing tools, but SAST is static (no execution) and DAST is dynamic (requires execution), and the question explicitly states 'without executing the program' to eliminate DAST.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Static Application Security Testing (SAST)
Static Application Security Testing (SAST) analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. It operates by scanning the codebase for known patterns, such as SQL injection or buffer overflow, using techniques like data flow analysis and taint tracking. This white-box approach identifies issues early in the Software Development Life Cycle (SDLC), making it the correct answer for testing that does not require runtime execution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Static Application Security Testing (SAST)
Why this is correct
Static Application Security Testing (SAST) tools analyze an application's source code, bytecode, or binary code without actually executing the program. This "white-box" testing approach identifies security vulnerabilities such as SQL injection, cross-site scripting (XSS), and buffer overflows by examining code patterns, data flow, and control flow paths that could lead to exploits. It is typically performed early in the Software Development Life Cycle (SDLC), providing developers with immediate feedback on potential flaws before deployment.
- ✗
Interactive Application Security Testing (IAST)
Why it's wrong here
Interactive Application Security Testing (IAST) operates within the running application, typically as an agent deployed on the application server, observing its behavior and data flow in real-time. While IAST combines elements of both static and dynamic analysis, its primary function is to analyze the application's runtime behavior and interactions, identifying vulnerabilities with high accuracy by correlating observed execution paths with known attack patterns. It does not solely analyze source code without execution, which is the specific focus of the question.
- ✗
Penetration testing
Why it's wrong here
Penetration testing involves simulating real-world attacks against a running system or application to identify exploitable vulnerabilities. This process often includes both manual techniques and automated tools to attempt to bypass security controls, gain unauthorized access, or extract sensitive data. Unlike static analysis, penetration testing focuses on the external attack surface and the system's response to malicious input, rather than examining the underlying source code directly.
- ✗
Dynamic Application Security Testing (DAST)
Why it's wrong here
Dynamic Application Security Testing (DAST) tools test an application from the outside by executing it and observing its behavior and responses to various inputs, much like an attacker would. This "black-box" approach identifies runtime vulnerabilities such as misconfigurations, authentication flaws, and injection vulnerabilities by analyzing HTTP requests and responses. However, DAST does not analyze the application's internal source code; it only interacts with the application's exposed interfaces.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
SDLC
The Software Development Life Cycle (SDLC) is a structured process used by IT teams to plan, create, test, and deploy software in a reliable and organized way.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.