DAST
Dynamic application security testing
Tools test a running application from outside by sending crafted requests and observing the responses, as ZAP does. They need no source code and find runtime and configuration flaws, but only on paths they can reach and authenticate to.
Covered in
Combine static and dynamic tests around a verified finding
Use analysis tools to find evidence, then retain an application regression that demonstrates the failure and the fix.
Place each security control in the pipeline and decide what it blocks
Put secrets scanning, SAST, SCA, IaC and image scanning, DAST, fuzzing, attestation and admission control where each sees the right input, block only on findings a developer can act on, and deploy only images the pipeline has attested.
Choose and evaluate application security testing tools
What SAST, DAST, IAST, SCA, secrets, IaC, container and API scanners and ASPM each find and miss, where each runs, how to evaluate them on a seeded repository with per-CWE scoring and triage cost, and which to adopt first.
Practice: Local project: Repair a security pipeline for GitHub Actions and GitLab CI