TechKnowSurge
CompTIA Security+ 4.3 CompTIA CySA+ 2.1 NIST NICE S0882 NIST NICE S0857 NIST 800-53 SR-3
TechKnowSurge Catalog Interactives Static, Dynamic or Package Monitoring?
InteractiveSecurityFree

Static, Dynamic or Package Monitoring?

Reading the source, firing junk at the running app, or tracking the libraries it pulls in: which kind of application testing is it?

⚑ Complete this interactive to capture a CTF flag worth 5 points.

About this interactive

The Discovering Application Vulnerabilities lesson covers how to find flaws in code you write. Static analysis: looking at the code itself, without running it. A reviewer or a tool can see all of the code, but some flaws only show up when the code runs. Dynamic analysis: running the code and watching how it behaves. It catches flaws that only appear at run time, but code that is never triggered during the test is never checked. Fuzz testing, or fuzzing, is a kind of dynamic analysis: the program is running, and it is fed random, malformed or unexpected input to see whether it breaks. Package monitoring: most software uses packages and code borrowed from other sources. Those components get updated and get new flaws of their own, so you watch them and update them. The lesson also calls this analyzing the software composition and its dependencies. Security+ (SY0-701 4.3) lists exactly these three: static analysis, dynamic analysis and package monitoring. A quick test for each card: is the code being read, is it running, or is the check about someone else's component the app depends on?

What you'll learn

Aligned to

CompTIA Security+
4.3 Explain various activities associated with vulnerability management.
CompTIA CySA+
2.1 Given a scenario, implement vulnerability scanning methods and concepts
NIST NICE
S0882 Skill in performing static analysis
S0857 Skill in performing dynamic analysis
NIST 800-53
SR-3 Supply Chain Controls and Processes

Key terms

Static Analysis
A method of identifying vulnerabilities by examining application source code without executing it.
Dynamic Analysis
A method of identifying vulnerabilities by executing code and observing its behavior at runtime.
Fuzz Testing
A testing technique that inputs random or unexpected data into a running application to uncover security vulnerabilities.
Software Composition Analysis
SCA
Software Composition Analysis is an automated security practice that identifies open-source and third-party components within an application and checks them against known vulnerability databases to detect license risks and exploitable dependencies.
Third-Party Dependency
An external vendor, supplier, or component—such as hardware, software libraries, or container images—that an organization relies on to deliver its products or services.

Topics

Vulnerability Management Application Security Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →