Question 69

Static analysis identifies but does not exploit vulnerabilities.

Static analysis is a method that involves examining the source code or binaries of a software application to identify potential vulnerabilities without executing the code. This approach allows for the detection of issues such as coding errors and security flaws without actively exploiting them.

A) Penetration test

A penetration test is designed to exploit vulnerabilities to assess the security of a system. This activity goes beyond identification, as it entails simulating attacks to determine the extent to which vulnerabilities can be exploited, making it an incorrect choice for the question.

B) Static analysis

Static analysis is focused on identifying vulnerabilities in the code without executing it, which aligns perfectly with the question's requirement. This method helps developers find potential issues early in the development cycle without the risk associated with exploiting those vulnerabilities.

C) Dynamic analysis

Dynamic analysis involves executing the application to identify vulnerabilities during runtime. This method assesses software behavior in real-time, which may lead to exploitation of vulnerabilities during the process, thus not fulfilling the requirement of merely identifying without exploitation.

D) Bug bounty

A bug bounty program incentivizes external researchers to find and report vulnerabilities, often leading to exploitation. Participants in such programs actively test systems, which contradicts the essence of identifying vulnerabilities without exploiting them.

Conclusion

Static analysis is the only option that strictly identifies vulnerabilities without engaging in their exploitation, making it the correct answer. In contrast, penetration testing, dynamic analysis, and bug bounty programs all involve some level of exploitation or testing that goes beyond mere identification.