Which security testing method analyzes source code to identify vulnerabilities that could expose an application to attack?

Which security testing method analyzes source code to identify vulnerabilities that could expose an application to attack?

• A. Dynamic Analysis
• B. Code Review
• C. Static Application Security Testing
• D. Storage Design Pattern

Answer: (C)

Static Application Security Testing analyzes the source code itself without running the program, looking for insecure coding patterns, dangerous API usage, and weaknesses that could lead to exploitation. By scanning the codebase early in development, it highlights issues such as injection points, improper input validation, weak cryptography, and risky dependency usage, allowing developers to fix problems before deployment. This makes it a proactive way to identify vulnerabilities at the source, often covering the entire codebase consistently. Dynamic analysis, on the other hand, tests a running application to find issues that appear during execution, while code review involves humans inspecting the code for problems, which can miss or be slower at identifying certain security flaws. Storage design pattern is not a testing method. So the best choice is Static Application Security Testing.