Which statement correctly distinguishes static application security testing (SAST) from dynamic application security testing (DAST)?
- ASAST runs the application and observes it from the outside, while DAST parses source code without executing anything.
- BSAST and DAST both require full source code access, differing only in the report format they produce.
- CSAST tests only third-party dependencies, while DAST tests only first-party code written in-house.
- DSAST inspects source code or byte code without executing the application, while DAST exercises the running application from the outside without needing the source. Correct
Why A is wrong: This is tempting because the two names are easily transposed, but it reverses them: SAST is the code-at-rest technique and DAST is the running-application technique.
Why B is wrong: It sounds reasonable because both are automated tools, but DAST does not need source access and the difference is the testing approach, not the report.
Why C is wrong: This confuses the pair with software composition analysis; neither SAST nor DAST is defined by whether the code is first- or third-party.
Why D is correct: This captures the defining mechanism: SAST is a white-box analysis of code at rest, whereas DAST is a black-box test against the running system.