Examkin

Question

Difficulty: MediumVulnerability Assessment and Security Testing Methods

An organization wants to analyze its newly deployed cloud microservices for runtime security flaws and improper error handling under live execution conditions. The assessment team has been provided with API specifications and functional documentation, but does not have access to the underlying application source code. Which security testing method should the organization perform to satisfy this requirement?

  1. Dynamic Application Security Testing (DAST)Answer
  2. B
    Static Application Security Testing (SAST)
  3. C
    Deploying deception honeypots within the API network segment
  4. D
    Applying inline web application firewall (WAF) filtering rules

Answer

Dynamic Application Security Testing (DAST) should be performed because it evaluates a running application in its operational environment without requiring access to source code.
Dynamic Application Security Testing (DAST) evaluates an application by injecting fault-inducing inputs into active endpoints during execution. Because DAST operates on a running instance using exposed interfaces (such as APIs), it does not require access to source code.

Step-by-Step Solution

1
Analyze the scenario constraints and requirements.
The application must be tested while running (execution state) and source code access is not available (black-box/gray-box testing condition).
Security assessment tools must align with available artifacts and application operational states.
2
Evaluate candidate security testing methodologies.
DAST interacts directly with exposed interfaces/APIs of an executing system to observe responses to malicious inputs and unexpected payloads.
DAST does not require source code and focuses specifically on runtime vulnerabilities.

Key Concept

Dynamic Application Security Testing (DAST) vs. Other Testing Methodologies
Rate this question

Topics

Vulnerability Assessment and Security Testing Methods

More questions from this topic