Dynamic Application Security Testing (DAST) is a method of finding security vulnerabilities by testing an application while it is running, without access to its source code.
A DAST tool interacts with a live application much as an attacker would, sending crafted requests and studying the responses to surface issues like injection, broken authentication, and server misconfigurations. Because it works from the outside as a black box, it catches problems that only show up at runtime, including flaws introduced by the deployment environment. A common example is probing a login form on the deployed app for SQL injection. The tradeoff is depth and precision. DAST sees fewer of the flaws buried deep in the code, and when it does report something it points to a symptom rather than the exact vulnerable line, so remediation takes more digging. It also needs a working test environment and can be slow. For that reason DAST is strongest when combined with static analysis, which reads the code directly and catches issues earlier.
How is DAST tested on the CISSP?
DAST maps to Domain 8, Software Development Security, which is 10% of the exam. Be ready to contrast black-box dynamic testing with white-box static analysis and explain when each applies.