Which testing method is performed while the app is running and users interact with the application's functionality?

• A. Fuzzer
• B. Interactive Application Security Testing
• C. Software Assurance
• D. Sandbox

Answer: (B)

Testing while the app is running and users interact with its functionality is the Interactive Application Security Testing approach. It works by instrumenting the running application so an agent can observe real user actions, the inputs they provide, how data flows through the code, and how the system responds in real time. This runtime visibility lets you see security issues as they surface during actual workflows, catching vulnerabilities that only appear when specific features are exercised and in realistic usage paths. Because the analysis is tied to the live behavior of the application, results reflect how the software operates under real-world conditions, often providing more accurate context and fewer false positives than some non-runtime methods.

Fuzzing, by contrast, focuses on generating large volumes of automated inputs to provoke issues without necessarily relying on actual user interactions. A sandbox is an isolated environment for running code securely, not a testing methodology itself. Software assurance is the broader practice of ensuring software is trustworthy, not a specific runtime testing technique.