A security analyst is tasked with assessing a newly deployed customer-facing web application before it goes live. The development team has provided access to the running application in a staging environment but is unwilling to share source code, and the application uses dynamic content generated at runtime. The analyst needs to identify vulnerabilities such as SQL injection, cross-site scripting, and authentication flaws as they would appear to an external attacker interacting with the live app. Which scanning approach is MOST appropriate for this assessment?