A security engineer has just been embedded in an agile development team to ensure security practices are maintained during frequent release cycles. A new web application includes an input form…

Question

Options

• ARunning a dynamic analysis at form submission
• BPerforming a static code analysis
• CFuzzing possible input of the form
• DConducing a runtime analysis of the code

• A
  76% (31)
• B
  2% (1)
• C
  7% (3)
• D
  15% (6)

Explanation

Dynamic analysis at form submission is the best technique for testing how a web application handles error conditions. Dynamic analysis executes the application in a live environment and observes its real-time behavior as inputs are submitted through the form. This allows the security engineer to deliberately submit edge-case, invalid, and boundary values and observe actual application responses-error messages, exception handling, HTTP status codes, and application state changes-as they occur in the running system. This directly reveals whether the application fails gracefully, exposes sensitive error details, or crashes. Static code analysis (B) examines source code without executing it and may miss runtime behavior. Fuzzing (C) is an automated subset of dynamic testing focused on random/unexpected inputs to find crashes, but is less controlled for observing specific error-handling paths. Runtime analysis (D) is similar to dynamic analysis but typically refers to profiling and performance measurement rather than security error-condition testing.

No community discussion yet for this question.