Examkin

Question

Difficulty: MediumVulnerability Assessment and Security Testing Methods

A security team is evaluating testing methodologies to identify vulnerabilities within a newly deployed web application. To satisfy compliance standards, the team must implement security testing techniques that analyze the application while it is actively executing in a target runtime environment. Which of the following assessment methods fulfill this requirement? (Select TWO)

  1. Dynamic Application Security Testing (DAST) to evaluate application responses to simulated attacks during executionAnswer
  2. Interactive Application Security Testing (IAST) to inspect runtime code execution and data flow using embedded software agentsAnswer
  3. C
    Static Application Security Testing (SAST) to inspect non-compiled source repositories for syntax security bugs
  4. D
    Software Composition Analysis (SCA) to identify known vulnerabilities in third-party library dependency files
  5. E
    Inline network honeypots deployed directly in front of the web server to block malicious payloads

Answer

The testing methods that analyze an application during active runtime execution are Dynamic Application Security Testing (DAST) and Interactive Application Security Testing (IAST).
Dynamic Application Security Testing (DAST) and Interactive Application Security Testing (IAST) both analyze application behavior in a running state. DAST interacts externally by sending payloads to an active web service endpoint and reviewing HTTP responses. IAST monitors runtime execution internally by combining software instrumentation agents with dynamic testing to observe memory state, database queries, and data flows while the application executes.

Step-by-Step Solution

1
Analyze the scenario requirements
Identified the core requirement: testing methods must analyze application behavior during active runtime execution.
Security assessment tools fall into static, dynamic, interactive, and dependency categories based on whether code executes during analysis.
2
Evaluate candidate testing methodologies
DAST tests from the outside while the application runs; IAST tests from the inside via agent instrumentation while the application runs.
Both DAST and IAST require an executing application instance to perform vulnerability discovery.
3
Differentiate runtime methods from passive or architectural tools
Eliminated static source code analysis (SAST), dependency tracking (SCA), and deception technologies (honeypots).
SAST and SCA analyze unexecuted code/manifests at rest, whereas honeypots are detection mechanisms rather than application vulnerability testing tools.

Key Concept

Runtime Application Security Testing (DAST vs. IAST)
Rate this question

Topics

Vulnerability Assessment and Security Testing Methods

More questions from this topic