Fundamentals of Secure Software - DAST (Dynamic Application Security Testing)

The video tutorial discusses dynamic analysis, specifically dynamic application security testing (DAS), a black box security testing methodology. It highlights DAS's strengths, such as being technology independent and useful for penetration testing, while also noting its weaknesses, like not pinpointing code vulnerabilities. Various dynamic security tools are mentioned, including White Hat, ZAP, Qualis, and Vera Code.

What is the primary characteristic of dynamic application security testing (DAST)?

• It tests applications from the inside.

• It is a white box testing methodology.

• It examines applications in their running state from the outside.

• It is highly dependent on the technology used.

Which of the following is a strength of DAST?

• It is highly dependent on the programming language.

• It always provides findings early in the software development life cycle.

• It can test software that you do not own.

• It can identify the exact line of code with vulnerabilities.

What is a limitation of DAST?

• It often results in many false positives.

• It can only be used in production environments.

• It is only useful for software you own.

• It cannot locate code-specific security issues like hard-coded passwords.

What is the role of a subject matter expert in the context of DAST findings?

• To verify the findings of the DAST.

• To develop the DAST tools.

• To ensure the application is running.

• To automate the testing process.

Which of the following is NOT a dynamic security tool mentioned in the video?

• Vera Code

• Nessus

• ZAP

• White Hat