B. From the CISSP book
Dynamic Testing
Dynamic application security testing (DAST) evaluates the security of software in a runtime
environment and is often the only option for organizations deploying applications written by
someone else. In those cases, testers often do not have access to the underlying source code.
One common example of dynamic software testing is the use of web application scanning
tools to detect the presence of cross-site scripting, SQL injection, or other flaws in web applications. Dynamic tests on a production environment should always be carefully coordinated
to avoid an unintended interruption of service.
Dynamic testing may include the use of synthetic transactions to verify system
performance. These are scripted transactions with known expected results. The testers run
the synthetic transactions against the tested code and then compare the output of the transactions to the expected state. Any deviations between the actual and expected results represent possible flaws in the code and must be further investigated
B. This method focuses on testing the application during runtime to identify security vulnerabilities in the code. While useful for security testing, it is more suited to identifying issues in specific parts of the code rather than providing a comprehensive end-to-end test of operational and security requirements in production.
A. By executing these synthetic transactions, you can verify that the system meets both operational and security requirements without impacting actual users.
Datadog
Operational Testing: Datadog is a comprehensive monitoring platform that offers infrastructure monitoring, application performance monitoring (APM), and log management. It provides real-time insights into application performance, user experience, and system health.
Security Testing: Datadog has integrated security monitoring features that allow you to detect threats and vulnerabilities in real-time. It includes security monitoring for infrastructure, application security, and integrates with security tools for comprehensive visibility.
Best Use Case: Datadog is suitable for organizations that need a cloud-native solution for both performance monitoring and security insights, especially in environments with complex, dynamic infrastructure.
Dynatrace
Operational Testing: Dynatrace offers advanced application performance monitoring, including real-time analytics, automated root cause analysis, and synthetic monitoring.
Security Testing: Dynatrace has a built-in security module (Dynatrace Application Security) that provides runtime application security monitoring. It detects vulnerabilities in third-party libraries, monitors for suspicious behavior, and integrates security into DevSecOps workflows.
Best Use Case: Suitable for organizations that want a unified platform for both performance and security monitoring, particularly in dynamic environments like microservices and cloud-native applications.
Answer B) Dynamic code analysis
Dynamic testing analyzes software security in the runtime environment. With this testing, the tester should not have access to the application’s source code.
Dynamic testing often includes the use of synthetic transactions, which are scripted transactions that have a known result. These synthetic transactions are executed against the tested code, and the output is then compared to the expected output. Any discrepancies between the two should be investigated for possible source code flaws.
FIrst you do not run tests in, production, but you can run Vulnerability analysis in production. In a testing environment you can run SAST to test both operational and security
B. Dynamic code analysis, also known as dynamic application security testing (DAST), includes both security and operational aspects when testing an application or system. It involves analyzing a running application to identify security vulnerabilities and operational issues while simulating real-world usage.
Synthetic transaction analysis is primarily focused on performance and operational testing, simulating user transactions to assess system performance and availability, but it may not specifically address security vulnerabilities.
So, in the context of assessing both operational and security requirements, dynamic code analysis (DAST) is the best answer choice.
Synthetic is a subset of Dynamic. Synthetic is more performance (operational) where Dynamic includes both security and operational
upvoted 4 times
...
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
DASH_v
Highly Voted 1 year, 6 months agodeeden
Most Recent 3 months, 1 week agodeeden
3 months, 1 week agodeeden
3 months, 1 week agodeeden
3 months, 1 week agoGuardianAngel
9 months, 2 weeks agogjimenezf
9 months, 3 weeks agogjimenezf
9 months, 3 weeks agoYesPlease
11 months agoSoleandheel
11 months, 1 week agothanhlb
1 year, 1 month agoaleXplicitly
1 year, 7 months agojackdryan
1 year, 6 months agopiszkergy
1 year, 7 months agoRollingalx
1 year, 8 months agoBodatiousbob
1 year, 8 months ago