City development is shipping a custom permitting app and wants coverage for insecure code, runtime flaws, and risky third-party libraries. Which approach best combines application security testing for vulnerability management?
Select an answer to reveal the explanation.
Short Explanation
Code review tools catch bad patterns before deploy, live tests poke the running app, and package monitors watch the libraries you pulled in—like checking the blueprint, the finished building, and the supplier list. For a custom permitting app you want all three, not just door locks or a firewall sheet.
Full Explanation
Static application security testing (SAST) examines source or binaries without executing them; dynamic application security testing (DAST) exercises the running application; package or software composition monitoring tracks vulnerable dependencies. Together they support application-focused vulnerability identification beyond network scans alone. Physical office audits and firewall reviews address different layers and cannot replace application security testing.