As part of the testing phase in the SDLC, a software developer wants to verify that an application is properly handling user error exceptions. Which of the following is the BEST tool or process for…

An SRTM (Security Requirements Traceability Matrix) review is a documentation audit that maps security requirements to test cases; it does not actively execute the application or trigger exception handling at runtime.

A fuzzer automatically generates random, malformed, or boundary-condition input and submits it to the application to observe how it responds. This directly exercises whether the application properly catches and handles runtime exceptions caused by bad user input, making it the ideal tool for verifying exception handling logic in the SDLC testing phase.

A vulnerability assessment scans for known security weaknesses across systems or code but does not specifically stress-test application exception handling logic with malformed input.

An HTTP interceptor captures and modifies HTTP traffic for manual or automated web testing but is not designed to generate the broad range of malformed input needed to trigger exception handling paths.