(Charles Rettig has been working as a DevSecOps engineer in an IT company that develops software and web applications for IoT devices. He integrated Burp Suite with Jenkins to detect vulnerabilities and evaluate attack vectors compromising web applications. Which of the following features offered by Burp Suite minimizes false positives and helps detect invisible vulnerabilities?)

Out-of-Band Application Security Testing (OAST) is a technique used to detect vulnerabilities that are not discoverable through traditional request-and-response scanning methods. Burp Suite's implementation of OAST is the Burp Collaborator. It works by sending payloads that cause the target application to interact with a Burp-controlled server over an external channel (e.g., DNS, HTTP). These "invisible" or out-of-band interactions confirm vulnerabilities like blind SQL injection or blind SSRF with high confidence, which significantly minimizes false positives compared to inferential-based scanning techniques.

B. QAST is not a recognized standard acronym within the application security testing domain.
C. MAST stands for Mobile Application Security Testing, which is a broad category of testing focused on mobile apps, not a specific technology for finding invisible vulnerabilities.
D. NAST is not a recognized standard acronym within the application security testing domain.

1. PortSwigger. "What is OAST (out-of-band application security testing)?". Web Security Academy. PortSwigger. "OAST can be used to detect issues that are completely invisible in the application's responses, such as blind SQL injection." (Source: https://portswigger.net/web-security/oast).

2. PortSwigger. "Burp Collaborator". Burp Suite Documentation. PortSwigger. "Burp Collaborator is a network service that Burp Suite uses to help discover many kinds of vulnerabilities... by inducing a target application to interact with the Collaborator server." (Source: https://portswigger.net/burp/documentation/collaborator).