The correct answer is Dynamic application security testing (DAST).

Dynamic application security testing (DAST) examines a running web application by interacting with it at runtime and it does not require access to source code or internal architecture. This makes it the appropriate choice when testers evaluate live web apps and have little or no internal knowledge of the code or infrastructure.

Vulnerability scanning typically performs automated checks against known vulnerabilities and missing patches on systems and services and it is not focused on the interactive, runtime testing of a web application in the same way as DAST.

Penetration testing can be performed with little internal knowledge when done as a black box assessment and it often includes exploitation and business logic testing, but it is a broader manual engagement rather than the specific automated dynamic analysis implied by DAST.

Static application security testing (SAST) analyzes source code or compiled binaries without running the application and it requires access to the code or build artifacts, so it does not fit a scenario where testers have little or no internal information.

Full AWS Practitioner Certification Question