Which type of application security testing tests running applications and includes tests such as web vulnerability testing and fuzzing?

Code Review is a manual or automated inspection of source code without executing the application, so it cannot perform runtime tests like fuzzing.

SAST analyzes source code, bytecode, or binaries without running the application, making it the opposite approach to DAST.

Unit Testing validates the correctness of individual code units or functions and is not a security testing methodology.

Functional Testing verifies that application features behave as specified, not that they are free of security vulnerabilities.

DAST tests applications in their running state by simulating external attacks, making it the category that encompasses web vulnerability scanning and fuzzing. Because it interacts with a live application, it can discover runtime issues such as injection flaws and authentication weaknesses that static analysis cannot detect. This distinguishes it from all other listed methods, which either analyze source code or test functionality rather than security.