23. Which of the following activities identifies but does not exploit vulnerabilities?
Answer: B
Static analysis identifies but does not exploit vulnerabilities.
Static analysis involves reviewing source code or binaries to identify potential security flaws without executing the program. This method allows developers to detect issues early in the development process without the risk of exploitation.
A) Penetration test
A penetration test actively seeks to exploit vulnerabilities in a system to determine the level of security. This method not only identifies vulnerabilities but also tests their exploitability, making it the opposite of static analysis.
B) Static analysis
Static analysis is a non-exploitative method that scans code for potential vulnerabilities without executing it. This approach helps in recognizing security issues during the development phase, ensuring that vulnerabilities can be addressed before deployment.
C) Dynamic analysis
Dynamic analysis involves testing a running application in real-time to identify vulnerabilities as they manifest during execution. Like penetration testing, this method can exploit vulnerabilities, thus differing from the non-exploitative nature of static analysis.
D) Bug bounty
A bug bounty program encourages ethical hackers to find and report vulnerabilities in exchange for rewards. This activity is inherently exploitative, as it allows participants to actively seek out and potentially exploit weaknesses in systems.
Conclusion
Static analysis stands out as the only method among the options that identifies vulnerabilities without exploiting them. While penetration tests, dynamic analysis, and bug bounty programs focus on discovering and exploiting vulnerabilities, static analysis provides a critical, non-intrusive approach essential for secure software development.