Question 100

Explanation

The correct answer: Static code analysis, also known as Static Application Security Testing (SAST), involves analyzing source code before it is compiled. It is generally faster because it can be done early in the development lifecycle and is able to examine all code paths and inputs in a systematic manner. It uses techniques such as data flow analysis and control flow analysis to find issues such as input validation errors, buffer overflows, etc. The incorrect answers: While manual code review is an important part of any secure development lifecycle, it is time-consuming and depends on the skill of the individual reviewer. It is also susceptible to human error and oversight, making it slower and potentially less reliable than automated analysis methods. Penetration testing is a method of testing the security of an application by simulating attacks from a malicious source. It is a valuable tool for identifying vulnerabilities but it is not as fast as static code analysis. It's a dynamic method which is performed when the application is running, meaning it can't start until the application is at least in a testable state. Moreover, it focuses on exploiting known vulnerabilities rather than evaluating all the possible paths through the code to identify potential issues. Dynamic code analysis, or Dynamic Application Security Testing (DAST), involves analyzing an application while it's running. It can identify runtime issues that static analysis might miss, such as access control issues, server configuration errors, etc. However, like penetration testing, it's a dynamic method which requires the application to be running and functional to some degree, so it can't be initiated as early in the development process as static analysis. Therefore, in terms of speed, it's slower than static code analysis.