AZ400-Q: place dynamic testing safely
A team wants to find runtime web vulnerabilities without scanning production destructively. Where should DAST run?
- A) Against a representative controlled test or staging environment. ✓
- B) Only against source files before compilation.
- C) Only after every production incident.
- D) Inside the package registry. Answer: A. DAST exercises a running application and should use a safe, representative target. Why not the others: Source scanning is SAST; late or registry-based testing is not the right control.