What does DAST stand for?
DAST stands for Dynamic Application Security Testing. Dynamic application security testing: scanning a running application from the outside, by sending crafted requests, to find flaws such as injection and misconfiguration. It needs no source code.
DAST tests an application while it runs. The scanner behaves like an attacker with no access to the code: it crawls pages and API endpoints, sends crafted input and watches the responses for signs of injection, broken authentication, exposed error messages or missing security headers. It finds issues that exist only in a deployed system, including configuration mistakes, but it cannot point to the faulty line of code and it only tests the paths it manages to reach.
DAST in practice: an example
Before a release, the pipeline deploys the build to a staging site and starts a DAST scan. The scanner submits a script tag in a search box, sees it come back unescaped in the response and reports cross-site scripting on that page, with the exact request it used.
What DAST is confused with
DAST vs SAST: what is the difference?
DAST needs a running application and no source code; SAST needs source code and no running application. Mature pipelines run both, because each finds what the other misses. What SAST stands for
DAST vs penetration testing: what is the difference?
A DAST scan is automated and repeatable. A penetration test is a person chaining weaknesses, including business-logic flaws a scanner does not understand. A scan does not replace the test.
Which exams cover DAST?
DAST is on the official CompTIA acronym list for one of the four exams covered here.
- CySA+ CS0-004: 2.4 (Vulnerability Management).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. Which flaw can a DAST scan find that static analysis of the source code would miss?
- A hard-coded password in a source file
- A web server that still exposes its default admin page
- An unused variable
- A missing code comment
Show the answer
B. A web server that still exposes its default admin page. The default admin page is a deployment problem that exists only on the running server. Static analysis sees the code, not how the server is configured.
2. A DAST scan of an application that requires sign-in reports almost nothing. What is the most likely reason?
- The application has no vulnerabilities
- The scanner had no credentials and never got past the sign-in page
- DAST cannot test web applications
- The source code was obfuscated
Show the answer
B. The scanner had no credentials and never got past the sign-in page. A dynamic scanner only tests what it can reach. Without an authenticated session it sees the sign-in form and little else, so an empty report says nothing about the rest.
Sources: NIST glossary: dynamic application security testing; NIST SP 800-218, Secure Software Development Framework (SSDF); OWASP: Vulnerability Scanning Tools. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.