Which statement correctly distinguishes static application security testing (SAST) from dynamic application security testing (DAST)?
ASAST runs the application and observes it from the outside, while DAST parses source code without executing anything.
BSAST and DAST both require full source code access, differing only in the report format they produce.
CSAST tests only third-party dependencies, while DAST tests only first-party code written in-house.
DSAST inspects source code or byte code without executing the application, while DAST exercises the running application from the outside without needing the source.check_circle Correct
Distinguish SAST as non-executing code analysis from DAST as testing of the running application. SAST analyses source or byte code statically to find flaws before runtime, giving it visibility into code paths; DAST attacks the deployed, running application from outside, seeing only observable behaviour and not the source. The distinction is execution state and code visibility.
Why A is wrong: This is tempting because the two names are easily transposed, but it reverses them: SAST is the code-at-rest technique and DAST is the running-application technique.
Why B is wrong: It sounds reasonable because both are automated tools, but DAST does not need source access and the difference is the testing approach, not the report.
Why C is wrong: This confuses the pair with software composition analysis; neither SAST nor DAST is defined by whether the code is first- or third-party.
Why D is correct: This captures the defining mechanism: SAST is a white-box analysis of code at rest, whereas DAST is a black-box test against the running system.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CCSP bank for this domain.
Abuse cases confirm that valid inputs produce the correct results, whereas functional tests deliberately misuse the application.
errorWhy it is wrong: This is tempting through symmetry but reverses the two: confirming valid behaviour is the functional test, not the abuse case.
Static application security testing (SAST), which reads the code base without running it.
errorWhy it is wrong: SAST is tempting because it also has visibility into code, but it never executes the application, so it cannot observe runtime execution.
Patching the underlying operating system and language runtime that host the application
errorWhy it is wrong: On PaaS the provider patches and maintains the runtime and operating system, so this sits with the provider and is not the customer's secure SDLC responsibility here.