A penetration tester is performing a code review. Which of the following testing techniques is being performed?

Dynamic analysis involves testing an application while it is actively running and observing its behavior; a code review requires no program execution and therefore does not qualify.

Fuzzing analysis involves sending malformed or unexpected inputs to a running application to trigger crashes or unexpected behavior; it requires execution and is a subset of dynamic analysis.

Static analysis involves inspecting source code, bytecode, or binaries without executing the application. A penetration tester performing a code review is directly reading and analyzing the code to identify vulnerabilities such as insecure function calls, hardcoded secrets, or logic flaws - which is precisely the definition and purpose of static analysis.

Run-time analysis is synonymous with dynamic analysis and involves observing application behavior during execution, which does not apply to a non-executing code review.