Which testing approach focuses on finding vulnerabilities by testing a running application from outside with no internal access?

Which testing approach focuses on finding vulnerabilities by testing a running application from outside with no internal access?

• A. Static Analysis
• B. Gray-box Testing
• C. Dynamic Application Security Testing (DAST)
• D. White-box Testing

Answer: (C)

Testing a running application from outside with no internal access focuses on evaluating the live surface of the app as it’s deployed. Dynamic Application Security Testing (DAST) is built for this scenario: it interacts with the running application over the network, without access to the source code or internal systems, to uncover vulnerabilities that appear during real operation. By sending crafted inputs, probing input validation, authentication, session handling, and misconfigurations, DAST reveals how the application behaves under attack-like conditions and what it leaks through its external interfaces. Static Analysis, in contrast, examines code or binaries without executing the program, looking for potential issues in the source or compiled form rather than runtime behavior. White-box Testing involves full internal access, including source code and internal design details, to assess internal logic and hidden paths. Gray-box Testing provides partial internal knowledge or access. These approaches aren’t about testing a live external instance from outside in the same way that DAST is.

Testing a running application from outside with no internal access focuses on evaluating the live surface of the app as it’s deployed. Dynamic Application Security Testing (DAST) is built for this scenario: it interacts with the running application over the network, without access to the source code or internal systems, to uncover vulnerabilities that appear during real operation. By sending crafted inputs, probing input validation, authentication, session handling, and misconfigurations, DAST reveals how the application behaves under attack-like conditions and what it leaks through its external interfaces.

Static Analysis, in contrast, examines code or binaries without executing the program, looking for potential issues in the source or compiled form rather than runtime behavior. White-box Testing involves full internal access, including source code and internal design details, to assess internal logic and hidden paths. Gray-box Testing provides partial internal knowledge or access. These approaches aren’t about testing a live external instance from outside in the same way that DAST is.