Which of the following is the BEST method to uncover known vulnerabilities in an AI-based web application that has been recently deployed?

Dynamic Application Security Testing (DAST) is the best method for uncovering known vulnerabilities in a deployed AI-based web application because it exercises the live system by sending crafted HTTP requests to identify exploitable weaknesses such as SQL injection, cross-site scripting, and authentication flaws that only manifest at runtime. It requires no access to source code, making it suitable for post-deployment use. DAST tools can be mapped to known vulnerability databases to identify and report CVEs affecting the running application.

Static Application Security Testing (SAST) analyzes source code or compiled binaries before execution and cannot test the runtime behavior, configuration, or deployment-specific vulnerabilities of an already-running application.

Runtime Application Self-Protection (RASP) is an active defense mechanism embedded in the application to block attacks in real time - it is not a testing or discovery tool for identifying vulnerabilities.

Interactive Application Security Testing (IAST) requires instrumentation agents inside the application and is best suited to development and QA pipelines, not to assessing a production deployment without agent access.