Examkin

Question

Difficulty: MediumVulnerability Assessment and Security Testing Methods

A security analyst is tasked with assessing a newly deployed web application hosted in a staging environment. The analyst needs to identify runtime vulnerabilities, such as parameter tampering and input validation flaws, operating from a black-box perspective without access to the underlying source code. Which of the following security testing methods is most appropriate for this assessment?

  1. Dynamic Application Security Testing (DAST)Answer
  2. B
    Static Application Security Testing (SAST)
  3. C
    Production Honeypot Deception Deployment
  4. D
    Passive Network Packet Sniffing

Answer

Dynamic Application Security Testing (DAST)
Dynamic Application Security Testing (DAST) operates as a black-box security testing method on executed code. It simulates external attacks against a running application to discover dynamic runtime vulnerabilities, such as input validation flaws, without needing access to the application's underlying source code.

Step-by-Step Solution

1
Analyze the operational requirements provided in the scenario.
The assessment requires identifying runtime flaws (such as input validation errors) on an active application from a black-box perspective (no source code access).
Understanding testing constraints narrows down the appropriate vulnerability assessment methodology.
2
Evaluate candidate security testing methodologies against the identified constraints.
Dynamic Application Security Testing (DAST) interacts with a running application by sending inputs and analyzing responses without inspecting source code.
DAST is specifically engineered for dynamic black-box testing of functional web applications.

Key Concept

Vulnerability Assessment and Security Testing Methods (DAST vs SAST)
Rate this question

Topics

Vulnerability Assessment and Security Testing Methods

More questions from this topic