Explanation:
Box 1: Static application security testing (SAST
All the source code must be tested for security vulnerabilities in Azure Repos before deploying the apps.
SAST (Static Application Security Testing) SAST tools analyze source code or bytecode early in the pipeline to identify security flaws before deployment. They provide deep insights into insecure coding patterns and vulnerabilities by scanning code syntax and data flows without executing the program.
Box 2: Dynamic Application Security Testing (DAST)
Once the apps are deployed to the test environment, they must be tested for security vulnerabilities.
Dynamic Application Security Testing (DAST) is the process of analyzing a web application through the front-end to find vulnerabilities through simulated attacks. This type of approach evaluates the application from the "outside in" by attacking an application like a malicious user would. After a DAST scanner performs these attacks, it looks for results that are not part of the expected result set and identifies security vulnerabilities.
Reference:
https://learn.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-devops-security