Which tool type is used for static analysis in security testing?

• A. SAST (static analysis)
• B. DAST (dynamic analysis)
• C. Fuzzers
• D. Penetration testing tools

Answer: (A)

Static analysis inspects code without executing it, looking for security weaknesses by examining syntax, data flow, and patterns in the source or compiled artifacts. Tools designed for this purpose are SAST, which stands for static application security testing. They analyze source code, bytecode, or binaries to identify vulnerabilities such as insecure API usage, hard-coded credentials, or unsafe data handling, all without running the program. This lets developers find and fix issues early in the development process and often integrate the checks into CI/CD pipelines.

Dynamic analysis, in contrast, evaluates the running application to observe its behavior under test inputs, revealing issues that appear during execution. Fuzzers generate a wide range of inputs to provoke crashes or unexpected behavior, which is typically a runtime test. Penetration testing tools simulate attacker techniques against a live system, combining methods to discover vulnerabilities in a real environment. Since the question focuses on static analysis, SAST is the appropriate tool type.