Question $$

$17$

An $$application $$security $$analyst $$at $$a $$software $$company $$is $$assessing $$a $$new $$software $$application

before $$its $$release $$to $$customers$.$Before $$deciding $$on $$the $$best $$approach $$for $$the $$assessment$,$the

analyst $$recalls $$that $$there $$are $$different $$methods $$of $$analysis $$to $$evaluate $$the $$software$\text{'}$s $$security

posture. $$The $$analyst $$wants $$to $$assess $$the $$software$\text{'}$s $$running $$state $$to $$identify $$potential

vulnerabilities $$during $$its $$execution$.$Considering $$the $$preference $$to $$evaluate $$the $$software $$in $$its

running $$state $$and $$identify $$vulnerabilities $$during $$execution$,$which $$type $$of $$examination $$should

the $$analyst $$primarily $$rely $$on

$?$

Dynamic $$analysis

Manual $$penetration $$testing

Static $$code $$review

Source $$code $$fingerprinting