What is the difference between SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing)?
❓ Interview Prompt: Compare SAST (inside-out source code analysis, SonarQube) vs DAST (outside-in runtime vulnerability scanning, OWASP ZAP).
Differentiating Application Security Testing tools:
| Feature | SAST (Static Analysis) | DAST (Dynamic Analysis) |
|---|---|---|
| Testing Vector | Inside-out: Scans raw source code / AST | Outside-in: Scans running application endpoints |
| Code Access | Requires full source code access | Zero code access required (Black-box) |
| Phase | Early CI/CD commit build phase | Late staging runtime environment phase |
| Flaws Detected | SQLi, hardcoded credentials, buffer overflow | Missing security headers, CORS flaws, auth bypass |
| Tool Examples | SonarQube, Semgrep, Snyk | OWASP ZAP, Burp Suite |
Code Implementation Example
# SAST CI Pipeline step scanning code with Semgrep
- name: Semgrep SAST Scan
run: semgrep --config=auto .Deploy SAST early in CI/CD to catch code flaws, and DAST in staging environments to verify runtime endpoint security.