Exam CCSP topic 1 question 382 discussion

Dynamic Application Security Testing (DAST) is a black-box testing methodology, meaning it tests applications without prior knowledge of the system’s internal structure or source code. In contrast, Static Application Security Testing (SAST) is a white-box approach that requires knowledge of the system, such as access to source code, architecture, and design documentation. Why Not the Others? A. Discovery → DAST involves discovery of vulnerabilities while the application is running, analyzing how it responds to real-world attacks. C. Scanning → Both SAST and DAST perform scanning, but DAST focuses on scanning an active, running application. D. Probing → DAST probes applications dynamically by injecting malicious inputs to identify vulnerabilities like SQL injection or XSS.

B. Knowledge of the system