Which practice evaluates an application's behavior in a running environment to detect security issues?

• A. Code Review
• B. Mutation
• C. Storage Design Pattern
• D. Dynamic Analysis

Answer: (D)

Evaluating how an application behaves while it’s actually running to uncover security issues is dynamic analysis. By executing the program in a real or simulated environment, you can observe runtime behavior, including how it handles inputs, how components interact, timing and concurrency effects, memory usage, and responses to unusual or malicious traffic. This run-time perspective reveals vulnerabilities that static review of code or design patterns can miss, such as input validation gaps, misconfigurations, and race conditions.

Static code review looks at the program without executing it, focusing on potential flaws in the source or binaries. The storage design pattern deals with how data is organized and stored rather than testing behavior at run time. Mutation testing involves altering code to see if tests catch the changes, which is more about test effectiveness than observing security behavior during execution. Dynamic analysis is the approach that directly examines the app in action to detect security issues.