What is the advantage of using dynamic application security testing (DAST) over static application security testing (SAST) methodology?

Question

Options

• AUnlike SAST, DAST is a blackbox and programming language agnostic.
• BDAST can dynamically integrate with most CI/CD tools.
• CDAST delivers more false positives than SAST.
• DDAST is slower but thorough.

• A
  88% (28)
• B
  3% (1)
• C
  6% (2)
• D
  3% (1)

Explanation

DAST tests a running application from the outside, simulating real-world attacker behavior - it does not require access to source code or knowledge of the underlying programming language, making it truly blackbox and language-agnostic. This is its primary advantage over SAST, which analyzes source code and is inherently tied to specific programming languages and requires access to the codebase. DAST can discover runtime vulnerabilities (authentication issues, injection flaws in execution, session management weaknesses) that are invisible to static analysis. Option B is incorrect because DAST integration with CI/CD is not its defining advantage. Option C is a disadvantage (more false positives is not good). Option D is incorrect - DAST is not necessarily slower than SAST.

No community discussion yet for this question.