Evaluating E-commerce App Security Without Source Code
Short answer
C Dynamic testing evaluates the application at runtime to identify security flaws without requiring source code access.
Question
Key Takeaways
The question tests the distinction between SAST (requires code), DAST (runtime/external), and Penetration Testing (exploitative/simulation). The trap is confusing runtime evaluation with aggressive exploitation.
When source code is unavailable for an e-commerce app in pilot, recommend dynamic testing (DAST) to evaluate security by analyzing runtime behavior and identifying vulnerabilities like SQL injection.
Common mistake: Many candidates choose Penetration Testing (D) because it also works without source code. However, pen testing is a broader security assessment service, whereas dynamic testing is the specific technical method for evaluating application code behavior at runtime, which fits the 'evaluate the software' prompt better.
Expert Analysis
Runtime Analysis Requirement
The scenario presents a black-box testing constraint: the e-commerce application is in a pilot phase and its source code is unavailable. This immediately disqualifies Static Application Security Testing (SAST), which requires direct access to source code, object code, or binaries to perform analysis without execution. Since the analyst cannot read the code, they must evaluate the software through its external interfaces.
Dynamic vs. Penetration Testing
While both Dynamic Application Security Testing (DAST) and Penetration Testing involve interacting with a running application, they serve different scopes and objectives. Penetration testing (Option D) is a comprehensive, goal-oriented assessment of security posture that simulates real-world attacks to exploit vulnerabilities for business impact. It is often manual, invasive, and conducted later in the lifecycle to validate defenses.
In contrast, Dynamic testing (Option C), specifically DAST, focuses on evaluating the application's behavior during runtime to identify functional and security flaws such as input validation errors, SQL injection, or cross-site scripting. For a pilot deployment where the primary goal is to "evaluate the security" of the software itself before full release, dynamic testing is the standard automated or semi-automated approach. It systematically scans the application while it runs, detecting vulnerabilities that static analysis would miss but without the aggressive exploitation nature of penetration testing.
Why Not Vulnerability Testing?
Vulnerability testing (Option B) typically refers to scanning infrastructure or known CVEs using signature-based tools. While useful, it does not fully capture the logic flaws and runtime behaviors specific to an application's unique implementation. As noted in community discussions, an application might have no known CVEs but still be insecure due to poor design, which dynamic testing is better suited to uncover in this context.
Therefore, given the lack of source code and the need to assess runtime behavior during a pilot, dynamic testing is the most appropriate recommendation.
Exam Strategy
When you see 'source code not available' or 'black box,' eliminate Static Testing (SAST) immediately. Then, distinguish between 'evaluating the software' (Dynamic/DAST) and 'simulating an attack' (Penetration Testing). Choose Dynamic Testing when the focus is on finding bugs and vulnerabilities in the application's runtime behavior, especially in earlier phases like pilots.
Frequently Asked Questions
Why isn't vulnerability testing the best answer?
What is the difference between Dynamic Testing and Penetration Testing?
Discussion 12 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 12
-
ChopSNap 👍 8 Answered DD. Penetration testing Since the source code is not available, static testing and vulnerability scanning are not feasible options. Dynamic testing, while useful, might not be sufficient to uncover deep-rooted vulnerabilities. Penetration testing is the most suitable approach in this case. It involves simulating real-world attacks to identify and exploit vulnerabilities in the application. This approach doesn't require access to the source code and can reveal critical security flaws that other testing methods might miss.
-
5134674 👍 5 Answered CPen testing is quite evasive and expansive, but not correct answer in this scenario, since the app is in its Pilot phase.
-
luiiizsoares 👍 4 Answered CCorrect Answer: C. Dynamic testing Analysis: Given that the application's source code is not available, dynamic testing is an appropriate method to evaluate the security of the software. Dynamic testing involves analyzing the application by executing it and observing its behavior during runtime, which allows for the identification of security vulnerabilities that may not be evident through code inspection alone.
-
Popeyes_Chicken 👍 3 Answered CSource code isn't available, dynamic testing definitely fits better due to it's broad nature. Assessing the application during runtime will allow you to check for issues with input validation, improper session handling and memory leaks or crashes. Penetration testing is usually done after broader testing such as dynamic testing.
-
magmadiver1937 👍 2 Answered CI chose C but I am not entirely confident. Static is a definite no because you dont have access to the code. Vulnerability Testing is a possible choice but that would only find CVEs; an App could have no CVEs but still not be secure. Dynamic testing is when you test by using it which could involve security tests. Pentesting also makes sense but it overlaps with Dynamic testing, i.e., you are testing for security problems or misconfiguration by interacting with it, and the term is more broad. In the real world if you had to do a security test for a new WebApp, you would say pentest or WebApp pentest, only devs say Dynamic Testing, but for this exam I think Dynamic Testing would be how CompTIA brain would answer.
Show 7 more comments
-
remoteeee 👍 2 Answered CDynamic testing evaluates an application while it is running, simulating real-world usage to identify vulnerabilities such as SQL injection, cross-site scripting (XSS), or authentication flaws. Since the source code is unavailable (black-box scenario), dynamic testing is an effective way to assess the security of the application without needing to analyze its internal structure.
-
SheikS 👍 2D Penetration testing Penetration testing simulates real-world attacks on the application to identify vulnerabilities that could be exploited by an attacker. This method doesn't require access to the source code and is effective in assessing the security of the application in its operational environment.
-
zecomeia_007 👍 2 Answered DPenetration testing simulates real-world attacks to identify vulnerabilities and assess the overall security posture of the application.
-
KANKALE 👍 2 Answered CAnswer is dynamic testing
-
Berro_b 👍 1 Answered CDynamic Application Security Testing (DAST) tests an application while it is running, without needing access to its source code.
-
ybyttv 👍 1why the vulnerability testing need source code?
-
1chung 👍 1 Answered CCorrect answer is C
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.