A team already runs static analysis on its source code. It now wants to test the deployed staging build of its web application from the outside, sending crafted requests to find exploitable flaws such as injection and broken authentication in the running system. Which testing type is this?

Dynamic application security testing analyzes an application while it runs, treating it as a black box. The scanner crawls the application, sends crafted inputs and malformed requests, and observes responses to identify exploitable behavior such as injection, cross-site scripting, broken authentication, session handling weaknesses and server misconfiguration. Because it needs no source code, DAST tests the application as deployed, including its runtime configuration, which is why it is typically run against staging environments in the pipeline. Static application security testing examines source or compiled code without executing it; it finds insecure patterns early but cannot observe runtime behavior, and the team already has it. Software composition analysis identifies third-party components and their known vulnerabilities; it does not send requests to the running application or test custom logic. Infrastructure as Code scanning evaluates deployment templates for risky settings before resources are created and has no view of how the web application handles input. Exam caveat: SAST and DAST are complementary; SAST finds issues early with code locations, while DAST confirms exploitability in a running system but cannot point to the exact line. Operational check: run the DAST scan against staging with authenticated session settings, triage findings for exploitability, and confirm critical results block promotion to production.