Software Engineering › Key terms › Y12 Secure Software Architecture › Dynamic application security testing (DAST)
Dynamic application security testing (DAST)
Term Key terms bank Y12 Secure Software Architecture
Also listed as: DAST
Definition
Testing the running application from the outside by sending it unexpected input to find vulnerabilities, without needing the source code; a black box method.
Example: DAST: tests while running; finds issues like XSS or broken authentication.
Found in: syllabus, sample exam and familiarisation guidelines, school notes.
Dynamic application security testing of the running app.
Where it is used in the test
Syllabus area: Y12 Secure Software Architecture.
Question types it can appear in
- Matching or table: 2025 Q13 table and sample Q8
- Multiple choice: Pick the option that matches the definition or example.
- Fill in the blanks: Choose this term to complete a statement or table.
- Short answer: Define, outline or explain it and tie it to the scenario.
Where it has appeared in the paper
Secure Software Architecture (Part A, B). Part letters follow each paper’s own layout.
Related past questions
- 2025 HSC Q13 (2 marks): SAST and DAST Secure Software Architecture (Part A) · 2 marks
- Sample exam Q8 (2 marks): SAST and DAST Secure Software Architecture (Part B) · 2 marks
These are the questions the flashcard set links to this term. Open each one and compare your answer with its marking criteria.
Study links
- Flashcard: Dynamic application security testing (DAST) in Secure Software Architecture (Year 12) · study that set
- Memorise: Test and evaluate security and resilience
- Key terms bank entry: DAST
- Master answer: sample-q8 (2 marks, table (classify SAST/DAST)) (Master model answers: Secure Software Architecture)
- Master answer: sample-q8 (2 marks, table (classify SAST/DAST)) (Master model answers: code, SQL, pseudocode, diagrams and tables)
- Notes: Code security strategies: code review, SAST, DAST, vulnerability assessment, pen testing (Secure Software Architecture (Year 12))
- Notes: Apply and evaluate strategies used by software developers to manage the security of… (Secure Software Architecture (Year 12))
How to use it in an answer
A model sentence
“Testing the running application from the outside by sending it unexpected input to find vulnerabilities, without needing the source code; a black box method.” Then apply it: DAST: tests while running; finds issues like XSS or broken authentication.
In a short answer, give the definition in your own words first, then tie it to the situation in the question. Do not copy the example above unless it fits the scenario.
Command words used with it
Technique for the question types
- Matching or table: Tick or match each statement to the right column (for example ORM v SQL, SAST v DAST).
- Multiple choice: Read all four options, rule out wrong ones, pick one; no penalty for guessing so never leave blank.
- Fill in the blanks: Choose the right word from a list; use exact syllabus terms.
- Short answer: One clear point per mark, use the stimulus and course terms, and answer the command word.
What the marking guidelines and feedback say
For revision: SAST = static, done before/without running the program, needs source code access. DAST = dynamic, done while the program is running, no source code access needed (reasoned from the syllabus, not copied from the image).
SAST = static, analyses code without running it; DAST = dynamic, tests the running application (simulated attacks, probing interfaces).
Worked answers from the marking guidelines
Sample exam Q8 (2 marks): SAST and DAST (2 marks): criteria and sample answer
Criteria
2: Correctly classifies all the strategies. 1: Correctly classifies THREE strategies, which must include ONE SAST and ONE DAST.
Sample answer
SAST: (2) and (5). DAST: (1), (3) and (4).
Common mistakes
- Use the term exactly as the syllabus words it, then link it to the scenario in the question; the 2025 feedback repeatedly rewards using the stimulus.
- Answer the command word: outline gives main points only, explain gives a reason or cause, discuss gives both sides.
Related terms
Same group in the syllabus: Determining vulnerabilities · Hardening systems · Handling breaches · Business continuity · Disaster recovery · Code review · Static application security testing (SAST) · Vulnerability assessment · Penetration testing