Dynamic Application Security Testing (DAST)

Dynamic Application Security Testing probes a running application from the outside, the way an attacker would. It is black-box testing: the tool needs no source code, only a URL or interface to attack. By sending crafted requests and watching how the live system responds, DAST finds flaws that only exist at runtime: authentication and session weaknesses, server misconfigurations, injection points that survive into production, and information leaked in error messages.

The trade-off mirrors SAST. Because DAST never sees the code, it cannot tell developers which line to fix, only which request produced the faulty behaviour. It also tests only what it can reach, so paths that need unusual state or credentials may go unexercised, and it arrives late: the application must be built and running before DAST can start, which pushes findings toward the expensive end of the SDLC.

Exam relevance: if a scenario mentions testing a running application with no access to source code, the answer is DAST; if the tester has the code and the program never executes, it is SAST. Also distinguish DAST from penetration testing: DAST is automated, broad, and repeatable, while a penetration test adds human creativity, chained exploits, and a defined scope and rules of engagement.