Static and Dynamic Application Security Testing (SAST & DAST)
Domain 9: Static and Dynamic Application Security Testing (SAST & DAST)
This domain tests how SAST and DAST find different classes of weaknesses and why neither proves an application is secure. Expect questions on placement in the lifecycle, coverage, triage, and false results.
Core rules and concepts
- SAST analyzes source, bytecode, or binaries without executing the application. It can run early, find code-level flaws such as unsafe data flow, and point to a file and line.
- DAST tests a running application from the outside. It exercises runtime behavior, configuration, authentication, and deployed endpoints, but sees only what it can reach.
- SAST tends to produce false positives and needs triage with data-flow context. DAST tends to miss issues that require code insight or unreachable paths.
- Use authenticated scans, API specifications, and seed data for better DAST coverage. Use build integration and incremental scanning for SAST.
- Triage by confirming exploitability and impact, then fix the root cause and add a regression test. Do not close a finding merely because a scanner reports it again.
- Combine SAST, DAST, dependency scanning, and manual review. Each has different blind spots.
Worked example
SAST flags a request parameter concatenated into a SQL string. The reviewer traces the parameter from the controller to the query and confirms it is reachable without sanitization. This is a true positive; the fix is a parameterized query plus a regression test. Separately, DAST cannot reach an administrative API because the scanner lacks credentials. That absence is not evidence that the API is safe. The reasoning is that SAST provides code context while DAST provides runtime evidence; coverage limits must be stated explicitly.
Traps that cost marks
Do not treat a clean scan as proof of security. Do not run intrusive DAST against production without authorization. Do not ignore authentication and session handling during DAST. Do not assume SAST understands all frameworks and custom data flows. Do not report every scanner finding as a confirmed vulnerability.
Review habit
For each finding, record the source, sink, reachability, prerequisites, evidence, and fix verification.