Dynamic application security testing (DAST)

Term Key terms bank

Jump to a topic

See every item in the sequence

Definition

Testing the running application from the outside by sending it unexpected input to find vulnerabilities, without needing the source code; a black box method.

Example: DAST: tests while running; finds issues like XSS or broken authentication.

Found in: syllabus, sample exam and familiarisation guidelines, school notes.

Short version to memorise (key terms bank)

Dynamic application security testing of the running app.

Where you'll use it in the test

Syllabus area: Y12 Secure Software Architecture.

Question types it can appear in

Matching or table: 2025 Q13 table and sample Q8
Multiple choice: Pick the option that matches the definition or example.
Fill in the blanks: Choose this term to complete a statement or table.
Short answer: Define, outline or explain it and tie it to the scenario.

Where it has appeared in the paper

Secure Software Architecture (Part A, B). Part letters follow each paper’s own layout.

How to use it

A model sentence

General advice, built from the definition and example above

“Testing the running application from the outside by sending it unexpected input to find vulnerabilities, without needing the source code; a black box method.” Then apply it: DAST: tests while running; finds issues like XSS or broken authentication.

In a short answer, give the definition in your own words first, then tie it to the situation in the question. Do not copy the example above unless it fits the scenario.

Command words used with it

From the linked past questions

Classify: Arrange or include in classes or categories. (Sample exam Q8 (2 marks): SAST and DAST)
Analyse: Identify components and the relationship between them; draw out and relate implications. (Sample exam Q8 (2 marks): SAST and DAST)

Official worked answer

Sample exam Q8 (2 marks): SAST and DAST (2 marks): official criteria and sample answer

Criteria

2: Correctly classifies all the strategies. 1: Correctly classifies THREE strategies, which must include ONE SAST and ONE DAST.

Sample answer

SAST: (2) and (5). DAST: (1), (3) and (4).

Open the question page

Go deeper

Flashcard: Dynamic application security testing (DAST) in Secure Software Architecture (Year 12) · study that set
Memorise: Test and evaluate security and resilience
Key terms bank entry: DAST
Master answer: sample-q8 (2 marks, table (classify SAST/DAST)) (Master model answers: Secure Software Architecture)
Master answer: sample-q8 (2 marks, table (classify SAST/DAST)) (Master model answers: code, SQL, pseudocode, diagrams and tables)
Notes: Code security strategies: code review, SAST, DAST, vulnerability assessment, pen testing (Secure Software Architecture (Year 12))
Full term page: every question, note and marking comment for Dynamic application security testing (DAST)

Check yourself

Explain “Dynamic application security testing (DAST)” in one sentence, give an example, and name a question type that could test it.

Reveal the answer