Compare SAST and DAST. Why use both, and their limits?

WHAT THIS TESTS: This question tests whether you understand the full spectrum of application security testing in a CI/CD context and can articulate why mature practices layer multiple techniques rather than relying on a single scan. Interviewers want to see that you know SAST and DAST operate at different phases of the lifecycle, examine different artifacts, and catch different classes of vulnerabilities.

A GOOD ANSWER COVERS: First, define SAST as static application security testing that analyzes source code without executing the program, often called white-box testing, and note that it is used early in development to catch flaws like SQL injection, buffer overflows, XML external entity attacks, and OWASP Top 10 risks before deployment. Second, define DAST as dynamic application security testing that simulates attacks on live running applications to find vulnerabilities only visible during execution, serving as a post-deployment assessment. Third, explain why mature teams use both: the CircleCI article notes that teams relying on just one type of testing leave applications vulnerable, and together these methods fill security gaps by covering pre-deployment code analysis and post-deployment runtime exposure. Fourth, outline the primary limitations: SAST cannot detect issues that only appear when the application is running, and DAST cannot provide early feedback on source code flaws because it requires a deployed live target.

COMMON WRONG ANSWERS: A major red flag is claiming that one approach replaces the other or that unit and integration tests are sufficient for security. Another mistake is describing SAST and DAST as competing tools rather than complementary layers; the article explicitly frames them as a paired strategy. Candidates also err by saying SAST requires a running application or that DAST analyzes source code directly.

LIKELY FOLLOW-UPS: An interviewer might ask how you would integrate these tools into a CI/CD pipeline, what specific SAST tools you have used such as Semgrep, Checkmarx, SonarQube, or Klocwork, or how you prioritize remediation when DAST finds a vulnerability in production. They may also ask about the difference between security testing and functional testing, since the article emphasizes that normal user-condition tests do not reveal security flaws.

ONE CONCRETE EXAMPLE: Suppose your team is building a web application. You configure Semgrep or SonarQube in the CI pipeline to scan code changes before merge for OWASP Top 10 violations; this SAST step catches a potential SQL injection in a data access layer. After deployment to staging, a DAST tool simulates malicious requests against the live application and discovers a vulnerability that only appears during execution, such as a flaw exposed by runtime data handling that static analysis could not see. The team fixes the code flaw pre-deployment thanks to SAST and patches the runtime issue before production thanks to DAST.

Source: circleci.com