Which testing approach performs security tests while the application is running and in use?

Which testing approach performs security tests while the application is running and in use?

• A. Continuous Delivery
• B. Fuzzer
• C. Interactive Application Security Testing
• D. Software Assurance

Answer: (C)

Interactive Application Security Testing is designed to run security tests while the application is active and in use. It instruments the running application or runs inside its runtime so you can observe real data flows, API calls, and user interactions as they happen. This live, in-context view lets you see how security controls behave under actual usage and helps identify vulnerabilities with precise location and data-flow details. It combines runtime observation with information about the code to reduce false positives and provide actionable findings. Continuous Delivery describes automated processes for building, testing, and deploying software, not a specific runtime security-testing method. A fuzzer generates many random or crafted inputs to find crashes or failures, which is dynamic testing but isn’t inherently integrated into the running application to observe real-use behavior with context. Software Assurance is a broad discipline focused on ensuring software is secure, not a particular runtime testing technique. The description matches Interactive Application Security Testing.

Interactive Application Security Testing is designed to run security tests while the application is active and in use. It instruments the running application or runs inside its runtime so you can observe real data flows, API calls, and user interactions as they happen. This live, in-context view lets you see how security controls behave under actual usage and helps identify vulnerabilities with precise location and data-flow details. It combines runtime observation with information about the code to reduce false positives and provide actionable findings.

Continuous Delivery describes automated processes for building, testing, and deploying software, not a specific runtime security-testing method. A fuzzer generates many random or crafted inputs to find crashes or failures, which is dynamic testing but isn’t inherently integrated into the running application to observe real-use behavior with context. Software Assurance is a broad discipline focused on ensuring software is secure, not a particular runtime testing technique. The description matches Interactive Application Security Testing.