AZ400-Q: SAST vs DAST
Q: A DevSecOps pipeline must catch a SQL-injection code smell in the application’s source as early as possible — before the app is built or run. Which class of security testing should the team add to the CI pipeline?
- A) DAST (dynamic)
- B) SAST (static) ✓
- C) A penetration test
- D) Software composition analysis
Answer: B. SAST (static application security testing) analyzes source code without executing the app, so it integrates early in CI and finds issues (bad patterns, injection-prone code) during development — the shift-left approach. DAST probes the running application; SCA scans third-party dependencies/licenses; pen tests are manual and late.
Why it helps
Distinguishing SAST vs DAST (and SCA) and knowing where each fits in the pipeline is a core “validate code for compliance” AZ-400 objective.
Related
static-analysis · dynamic-analysis · dev-sec-ops · compliance-gate