DAST checks software functionality in ____________.

While DAST *can* be performed in a production environment, it is more commonly and safely done in a pre-production or staging environment; the core principle is testing in a runtime state, not necessarily production specifically.

Dynamic Application Security Testing (DAST) operates by executing the application and observing its behavior in a runtime state, typically by simulating attacks against it. This method allows DAST tools to identify vulnerabilities that only appear when the application is actively running and interacting with its environment, such as injection flaws or authentication bypasses.

DAST can be applied to applications deployed in the cloud, but 'the cloud' describes the deployment environment, not the state in which the software is tested.

DAST can be used for applications running in an IaaS configuration, but IaaS refers to the infrastructure service model, not the operational state of the software during testing.