Examkin

Question

Difficulty: HardVulnerability Assessment and Security Testing Methods

A Lead DevSecOps Engineer is configuring automated security testing within a continuous integration and continuous deployment (CI/CD) staging environment for a WebAssembly-based microservice application. The company requires a vulnerability assessment solution that evaluates the application while it executes, using embedded software agents within the runtime environment to correlate dynamic runtime behavior with the exact lines of source code causing vulnerabilities, thereby minimizing false positives. Which of the following security testing methods best fulfills these requirements?

  1. Interactive Application Security Testing (IAST)Answer
  2. B
    Static Application Security Testing (SAST)
  3. C
    Non-credentialed Dynamic Application Security Testing (DAST)
  4. D
    Inline Deception Technology Deployment

Answer

Interactive Application Security Testing (IAST) is the correct choice because it evaluates application execution from within the runtime environment using instrumented agents to correlate dynamic flaws with precise source code locations.
Interactive Application Security Testing (IAST) combines static and dynamic analysis principles by instrumenting the runtime environment with software agents. As functional tests execute against the application, IAST monitors real-time memory, HTTP requests, and data flows internally, allowing it to pinpoint exact source code vulnerabilities with low false-positive rates.

Step-by-Step Solution

1
Analyze the operational constraints specified in the scenario.
The requirement demands evaluating application behavior during execution (runtime), utilizing internal agents, and mapping flaws to exact source code line numbers with minimal false positives.
Security assessment methods differ significantly based on whether code is analyzed at rest, externally during execution, or interactively within the runtime engine.
2
Evaluate candidate application security testing methodologies against the requirements.
IAST combines the benefits of static and dynamic testing by leveraging internal execution monitoring agents during runtime.
Only IAST embeds agents directly inside the execution environment to monitor real-time data flows and correlate execution states back to underlying source code.

Key Concept

Application Security Testing Methodologies (IAST vs. SAST vs. DAST)
Estimated Time:1m 30s
Rate this question

Topics

Vulnerability Assessment and Security Testing Methods

More questions from this topic