A company is in the process of implementing a new front end user interface for its customers, the goal is to provide them with more self service functionality. The application has been written by…

Unit testing of binary code validates functional correctness and does not reveal security vulnerabilities such as injection flaws or access control weaknesses; it is not a recognized SDL security activity for web front-end applications.

Reviewing only a sampling of source code leaves large portions of the codebase unanalyzed, making it significantly less effective than the full static code review described in choice E.

Black box penetration testing provides no visibility into application internals, resulting in lower vulnerability discovery rates compared to grey box testing where partial knowledge enables more targeted and effective test cases.

Grey box penetration testing gives testers partial knowledge of the system architecture, closely mimicking a real attacker's perspective and uncovering exploitable vulnerabilities in authentication flows, input handling, and business logic that black box testing would likely miss.

Static code review of the entire front-end source code allows analysts to systematically identify all instances of insecure coding patterns - such as XSS, injection, and insecure direct object references - before deployment, providing coverage that no runtime test alone can achieve.