Application Security
What you must know
AppDynamics Application Security (formerly Secure Application) instruments the same agents to detect runtime application security threats without code changes. Candidates should understand the main detection categories: SQL injection, command injection, path traversal, unsafe deserialization, and server-side request forgery (SSRF), plus sensitive data exposure and weak hashing/crypto findings. Know how policies are configured (detection mode vs. blocking mode), how attack events are surfaced and correlated to business transactions, and how vulnerabilities differ from attacks - a vulnerability is a code weakness; an attack is an observed exploitation attempt at runtime.
Traps
A frequent trap is conflating detection with blocking: many questions describe an alert firing but no request being stopped - that is detection mode, and blocking requires explicit policy configuration. Another is assuming Application Security replaces a WAF; it observes at the application layer and complements perimeter defenses. Watch for questions that treat a vulnerability finding as proof of compromise - it is not. Also distinguish sensitive data exposure (data leaving in responses/logs) from injection attacks.
Worked example / rule of thumb
A request reaches a BT with a payload matching a SQL injection signature. Rule of thumb: classify first, then act. Determine whether the event is an attack (runtime attempt) or a vulnerability (latent weakness), check the active policy mode, and confirm whether the request was blocked or only reported. If only reported, the policy is in detection mode.
Key concepts checklist
- Attack types and injection categories
- Detection vs. blocking policy modes
- Vulnerabilities vs. runtime attacks
- Correlation of security events to BTs
- Sensitive data and crypto findings