問題文
A software house runs one tool over its source code before the build and another against the running application in a test environment. What does each tool find that the other tends to miss?
選択肢
- The two tools find the same set of problems, so a software house that runs both is duplicating effort and should choose whichever of the two fits more comfortably into its existing build pipeline.
- Runtime testing removes the need for source analysis, because a defect that cannot be triggered at runtime cannot be exploited.
- Source analysis finds configuration problems and runtime testing finds coding problems, because a configuration file is part of the source tree and the behavior of the code can only be judged while the application is actually running in the test environment.
- Source analysis finds insecure patterns anywhere in the code, while runtime testing finds problems that only appear once the parts are assembled and configured.