nVisium interview question

What is your testing methodology when you're performing a dynamic application security test?