Software Engineering › Key terms › Y12 Secure Software Architecture › Static application security testing (SAST)
Static application security testing (SAST)
Term Key terms bank Y12 Secure Software Architecture
Also listed as: SAST
Definition
Analysing the source code without running it to find security flaws early in development; a white box method.
Example: SAST = code NOT running, source visible, early. DAST = program running, from outside, finds runtime flaws.
Found in: syllabus, school notes.
Static application security testing of source code without running it.
Where it is used in the test
Syllabus area: Y12 Secure Software Architecture.
Question types it can appear in
- Matching or table: Classify features as SAST or DAST (2025 Q13 and sample Q8)
- Multiple choice: Pick the option that matches the definition or example.
- Fill in the blanks: Choose this term to complete a statement or table.
- Short answer: Distinguish SAST from DAST
Where it has appeared in the paper
Secure Software Architecture (Part A, B). Part letters follow each paper’s own layout.
Related past questions
- 2025 HSC Q13 (2 marks): SAST and DAST Secure Software Architecture (Part A) · 2 marks
- Sample exam Q8 (2 marks): SAST and DAST Secure Software Architecture (Part B) · 2 marks
These are the questions the flashcard set links to this term. Open each one and compare your answer with its marking criteria.
Study links
- Flashcard: Static application security testing (SAST) in Secure Software Architecture (Year 12) · study that set
- Memorise: Test and evaluate security and resilience
- Key terms bank entry: SAST
- Notes: Apply and evaluate strategies used by software developers to manage the security of… (Secure Software Architecture (Year 12))
- Master answer: sample-q8 (2 marks, table (classify SAST/DAST)) (Master model answers: Secure Software Architecture)
- Master answer: sample-q8 (2 marks, table (classify SAST/DAST)) (Master model answers: code, SQL, pseudocode, diagrams and tables)
- Notes: Code security strategies: code review, SAST, DAST, vulnerability assessment, pen testing (Secure Software Architecture (Year 12))
How to use it in an answer
A model sentence
“Analysing the source code without running it to find security flaws early in development; a white box method.” Then apply it: SAST = code NOT running, source visible, early. DAST = program running, from outside, finds runtime flaws.
In a short answer, give the definition in your own words first, then tie it to the situation in the question. Do not copy the example above unless it fits the scenario.
Command words used with it
Technique for the question types
- Matching or table: Tick or match each statement to the right column (for example ORM v SQL, SAST v DAST).
- Multiple choice: Read all four options, rule out wrong ones, pick one; no penalty for guessing so never leave blank.
- Fill in the blanks: Choose the right word from a list; use exact syllabus terms.
- Short answer: One clear point per mark, use the stimulus and course terms, and answer the command word.
What the marking guidelines and feedback say
For revision: SAST = static, done before/without running the program, needs source code access. DAST = dynamic, done while the program is running, no source code access needed (reasoned from the syllabus, not copied from the image).
SAST = static, analyses code without running it; DAST = dynamic, tests the running application (simulated attacks, probing interfaces).
Worked answers from the marking guidelines
Sample exam Q8 (2 marks): SAST and DAST (2 marks): criteria and sample answer
Criteria
2: Correctly classifies all the strategies. 1: Correctly classifies THREE strategies, which must include ONE SAST and ONE DAST.
Sample answer
SAST: (2) and (5). DAST: (1), (3) and (4).
Common mistakes
- Use the term exactly as the syllabus words it, then link it to the scenario in the question; the 2025 feedback repeatedly rewards using the stimulus.
- Answer the command word: outline gives main points only, explain gives a reason or cause, discuss gives both sides.
Related terms
Same group in the syllabus: Determining vulnerabilities · Hardening systems · Handling breaches · Business continuity · Disaster recovery · Code review · Dynamic application security testing (DAST) · Vulnerability assessment · Penetration testing