Question
A penetration tester is performing a security review of a web application. Which of the following should the tester leverage to identify the presence of vulnerable open-source libraries?
- A. VM
- B. IAST
- C. DAST
- D. SCA Correct
Explanation
Software composition analysis (SCA) inventories the third-party and open-source components an application uses and matches their versions against known vulnerabilities. DAST and IAST test the running application's behaviour rather than its dependency list, and VM (vulnerability management) is the broader process, not a technique for finding vulnerable libraries.
