Testers are asked to assess a cloud web application from the outside, sending crafted requests to the running application, with no access to its source code or internal design. Which testing approach does this describe?
Select an answer to reveal the explanation.
Short Explanation
You're the burglar rattling doors and windows from the street, with no floor plan. Testing a running app from the outside with no code is DAST, the black-box approach. If you'd been handed the source, or put a sensor inside the app, it'd be a different test.
Full Explanation
Dynamic application security testing evaluates an application while it runs by interacting with it the way an external user or attacker would: crawling pages and APIs, submitting crafted inputs, and analyzing responses for signs of vulnerabilities such as injection, cross-site scripting, misconfiguration and authentication weaknesses. Because it needs no source code or design knowledge, it is a black-box technique, and it finds issues that appear only at runtime, including server and framework configuration problems. It may miss paths it cannot reach. Static application security testing is the opposite approach: it inspects source or compiled code without running it, which requires access the testers in this scenario do not have. Software composition analysis inventories open-source and third-party components and matches them against known vulnerabilities and licenses; it works from manifests and binaries, not by attacking a running application. Interactive application security testing places an agent inside the application to watch execution while tests run, which requires deploying instrumentation into the application and therefore internal access. Exam caveat: DAST in the cloud should be authorized and coordinated, since some providers require notice or restrict testing of their own infrastructure. Operational check: confirm DAST runs against a staging environment in the pipeline with authenticated scanning configured, and that results are triaged before release.