AZ400-Q: select a runtime security test
A team needs to identify security weaknesses that appear only when its web application is running and handling HTTP requests. Which pipeline/security control is most appropriate?
- A) SAST only, with no running application.
- B) A Git tag naming convention.
- C) DAST against an authorized deployed test environment. ✓
- D) A storage lifecycle policy.
Answer: C. Dynamic application security testing exercises a running application from the outside. It complements SAST, which analyzes code without executing the application.
Why not the others: SAST and DAST solve different problems. Tags and storage policies do not test runtime web behavior.