Which testing approach evaluates a running application from the outside without access to source code?

Which testing approach evaluates a running application from the outside without access to source code?

• A. Static Analysis
• B. Gray-box Testing
• C. Dynamic Application Security Testing (DAST)
• D. White-box Testing

Answer: (C)

Dynamic testing of a live, externally accessible application to find vulnerabilities without access to the source code. This approach, often called dynamic application security testing, examines how the running app behaves under real use from an outside perspective. It tests the interfaces exposed to users or other systems (like web pages, APIs, and input fields) by sending inputs, observing responses, and looking for issues such as injections, misconfigurations, or insecure handling of data. Since the tester isn’t inspecting the code, the focus is on runtime behavior and how the app stands up to attack-like interactions in its actual environment. This differs from static analysis, which analyzes code without running it, and from white-box testing, which uses full internal knowledge and source code. Gray-box testing sits in between, offering partial internal insight, but the scenario described—evaluating the running application from the outside without code access—best fits dynamic, external testing of the live app.

Dynamic testing of a live, externally accessible application to find vulnerabilities without access to the source code. This approach, often called dynamic application security testing, examines how the running app behaves under real use from an outside perspective. It tests the interfaces exposed to users or other systems (like web pages, APIs, and input fields) by sending inputs, observing responses, and looking for issues such as injections, misconfigurations, or insecure handling of data. Since the tester isn’t inspecting the code, the focus is on runtime behavior and how the app stands up to attack-like interactions in its actual environment.

This differs from static analysis, which analyzes code without running it, and from white-box testing, which uses full internal knowledge and source code. Gray-box testing sits in between, offering partial internal insight, but the scenario described—evaluating the running application from the outside without code access—best fits dynamic, external testing of the live app.