A development team installs an agent inside its cloud application's runtime. While the QA team runs normal functional tests, the agent observes code execution and data flows and reports where untrusted input reaches a dangerous function. Which testing approach is this?

Interactive application security testing combines aspects of static and dynamic testing by instrumenting the running application with an agent. As functional or automated tests exercise the application, the agent observes requests, code paths and data flows from the inside, and reports when untrusted input reaches a sensitive operation such as a query, file access or command execution without proper handling. Because it sees both the request and the code that processed it, IAST tends to produce accurate findings with precise code locations and fits naturally into QA and CI/CD stages that already run tests. Static testing analyzes code without executing it, so it would not depend on QA test runs or observe live data flows. Dynamic testing attacks the running application from outside without internal instrumentation, so it cannot see which internal function the input reached. Runtime application self-protection also uses an in-process agent, but its purpose is to detect and block attacks in production in real time rather than to report vulnerabilities found during testing; the scenario describes testing by the QA team, not protection of live traffic. Exam caveat: IAST coverage is only as good as the tests that drive it, because code paths never exercised are never observed. Operational check: confirm the IAST agent is deployed only in test environments, that functional test coverage is measured, and that findings feed the same defect tracker as other security tests.