69. Which of the following activities identifies but does not exploit vulnerabilities?
Answer: B
Static analysis identifies but does not exploit vulnerabilities.
Static analysis is a method used to examine code for potential vulnerabilities without executing it, thus ensuring that vulnerabilities are identified without being exploited.
A) Penetration test
Penetration testing involves simulating attacks on a system to exploit vulnerabilities. This means that while it identifies vulnerabilities, it actively attempts to exploit them, which does not align with the requirement of only identifying vulnerabilities.
B) Static analysis
Static analysis is the correct answer as it focuses solely on examining the code for vulnerabilities without executing it. This allows for the identification of potential security flaws without the risk of exploiting them.
C) Dynamic analysis
Dynamic analysis tests a program during execution to identify vulnerabilities, often involving exploitation of the identified weaknesses. Therefore, it does not meet the criteria of simply identifying vulnerabilities without exploitation.
D) Bug bounty
A bug bounty program encourages external testers to find and report vulnerabilities, often leading to exploitation in the process of discovery. This approach does not limit itself to identification alone, as it allows for exploitation to occur.
Conclusion
Static analysis is the only option that exclusively focuses on identifying vulnerabilities without exploitation, making it the definitive answer. All other options involve some level of exploitation or testing that goes beyond mere identification of vulnerabilities.