What is the key difference between SAST and DAST in application security testing?

• A. SAST analyzes source code or binaries without executing; DAST tests the running application from the outside.
• B. SAST tests the running application; DAST analyzes source code.
• C. SAST requires production to run; DAST only in development.
• D. SAST is manual; DAST is automated.

Answer: (A)

The key idea is how the testing approaches interact with the software. SAST looks at the code or compiled binaries without running the program, so it can catch vulnerabilities in how the software is written early in development. DAST runs the application in a live state and tests it from the outside, using real inputs to reveal issues that only show up during execution, such as runtime input handling and responses. Therefore, the option stating that SAST analyzes source code or binaries without executing and DAST tests the running application from the outside is the best fit. The other statements mix up where testing happens or whether it requires a running app, which doesn’t align with how these techniques operate.