A company is developing a new web application for its Internet users and is following a secure coding methodology. Which of the following methods would BEST assist the developers in determining if…

Web server load tests measure performance and availability under high traffic but do not probe for security vulnerabilities.

Static code analysis examines source code for known insecure patterns without executing it, so it cannot find runtime vulnerabilities triggered by unexpected input.

Fuzzing (fuzz testing) is specifically designed to uncover unknown and unexpected vulnerabilities by feeding an application with large volumes of random, semi-random, or mutated input data and observing crashes, errors, or unexpected behavior. Because the inputs are not derived from known attack patterns, fuzzing can reveal zero-day-class vulnerabilities that other testing methods overlook. This makes it the best choice when the goal is to find vulnerabilities that are not yet known.

SQL injection and XSS attacks test for specific, already-known vulnerability classes and would not discover novel or unknown vulnerability types.