Which of the following security concepts identifies input variables which are then used to perform boundary testing?

An application baseline documents the normal operating behavior and configuration of an application, used as a reference for detecting anomalies, not for testing input boundaries.

Application hardening reduces an application's attack surface by disabling unnecessary features and applying security configurations, but it does not involve feeding test inputs to probe boundaries.

Secure coding is the practice of writing software that resists attack by following security best practices during development, which is a proactive design practice rather than a testing technique.

Fuzzing works by identifying all input variables an application accepts and then systematically supplying boundary-violating, random, or malformed values to trigger unhandled exceptions, crashes, or unexpected behavior. This technique is particularly effective at uncovering buffer overflows, format string bugs, and input validation failures. The results reveal code paths that lack proper input sanitization or bounds checking.