Question

A development team is building an internal REST API in Java. Their security lead wants to identify insecure coding flaws — such as hardcoded credentials and unsafe deserialization — early in the software development lifecycle, before any build is deployed to a running environment. Which type of analysis tool is BEST suited to meet this requirement?

Accepted Answer

Static application security testing (SAST) that inspects source code

Answer

Dynamic application security testing (DAST) against the deployed endpoint

Answer

Interactive application security testing (IAST) using runtime instrumentation

Answer

A network vulnerability scanner performing an authenticated host scan