A security consultant is defining security testing methodologies for an organization's software development lifecycle (SDLC). Match each application security testing method to its corresponding operational characteristic.
- Static Application Security Testing (SAST)Analyzes source code or compiled binaries offline without executing the application to detect structural code flaws.
- Dynamic Application Security Testing (DAST)Evaluates a running application in a test environment from an external boundary by analyzing black-box HTTP responses.
- Interactive Application Security Testing (IAST)Employs runtime instrumentation agents inside the application engine to inspect code execution during functional testing.
- Software Composition Analysis (SCA)Inspects open-source components and third-party libraries for known vulnerabilities (CVEs) and compliance licensing risks.
Answer
Static Application Security Testing (SAST) pairs with analyzing source code offline without executing the application. Dynamic Application Security Testing (DAST) pairs with evaluating a running application externally via black-box HTTP analysis. Interactive Application Security Testing (IAST) pairs with employing runtime instrumentation agents inside the application engine. Software Composition Analysis (SCA) pairs with inspecting open-source components and third-party libraries for known CVEs.
Each application security testing methodology targets a distinct phase or perspective within software security evaluation: SAST inspects static source code, DAST tests external running interfaces, IAST uses runtime instrumentation for internal execution visibility, and SCA identifies risks in third-party software dependencies.
Step-by-Step Solution
Key Concept
Application Security Testing Methodologies (SAST, DAST, IAST, SCA)
Estimated Time:1m 30s