Exam CAS-005 topic 1 question 67 discussion

❌ Why not the others? A. Input validation: This is a secure coding practice, not a vulnerability assessment technique. C. Side-channel analysis: Typically used in hardware security or low-level cryptographic attacks — not relevant for general Java app vulnerability discovery. D. Fuzz testing: Good for finding unexpected crashes or behavior, but not as exhaustive or informative as dynamic analysis in most enterprise use cases. E. Static analysis: Looks at code without executing it, so it doesn't reveal runtime issues like environment-specific bugs or dynamic dependencies.

✅ B. Dynamic analysis Explanation: The question states the application is written in Java and the analyst must identify vulnerabilities during runtime. The keyword here is "during runtime." Dynamic Analysis: Involves analyzing the application while it is running. Detects runtime vulnerabilities like memory leaks, injection attacks, authentication issues, insecure session handling, and more. It provides a comprehensive and realistic view of how the application behaves in the real world. Often done through tools like DAST (Dynamic Application Security Testing).