Application Security: Runtime Vulnerabilities, Code and Posture
Application Security tests your grasp of how Dynatrace finds and prioritises risk in running applications: which libraries actually load, how first-party code is analysed, how posture findings differ from code findings, and how scope rules quietly determine what you see.
Coverage layers
- Runtime Vulnerability Analytics evaluates libraries that a monitored process actually loads and executes. Findings reflect executed code paths, so a library present on disk but never initialised is not reported for that process.
- Software composition analysis supplies the library and bill-of-materials view; code-level vulnerability analytics adds first-party source findings for supported technologies.
- Kubernetes security posture management and cloud security posture management evaluate configuration and compliance, not application libraries - different data, different remediation owners.
- Runtime Application Protection inspects incoming requests for attack patterns; it operates in monitoring or blocking mode and produces security events rather than vulnerability findings.
Scoring and scoping
- Davis security score blends severity (CVSS), exposure such as internet reachability, the sensitivity of data assets touched, exploit availability, and whether the vulnerable code is genuinely loaded.
- Management zones, security settings and exclusion rules decide which processes and hosts are analysed. A clean report can simply mean an empty scope, which is the most common false conclusion in these questions.
Worked example
A logging library with a critical CVSS score is reported across hundreds of hosts, yet one cluster shows a low score. Reasoning: the cluster's service never initialises the vulnerable component and is not internet-facing, so exposure and loaded-code factors pull the score down. The correct action is to patch the four hosts that do load it and apply an expiring exemption elsewhere, not to mute the rule permanently.
Traps that cost marks
- Treating raw CVSS as the final priority instead of the contextual score.
- Confusing a vulnerability with an observed attack - one is exposure, the other is an event.
- Blanket exemptions or exclusions that also suppress future findings on the same entity.
- Assuming unmonitored hosts or unsupported technologies are vulnerability-free.