It's A and B. "Taint sources are locations in the program where data is being read from a potentially risky source, and include things like environment variables, data, files, file metadata" This is something we review during static code analysis along with proper coding style and standards.

Are A and B the right answers? C may be wrong.

will go with A and B based on: https://owasp.org/www-community/controls/Static_Code_Analysis

Selected Answer: AB Static code analysis complements dynamic testing to provide extra advantages: - Error detection: Static code analysis can identify hundreds of classes of bugs related to concurrency, tainted data, data flow, and static and dynamic memory. Some bugs are almost impossible to detect with the dynamic testing. - Security vulnerabilities detection: Static code analysis can detect common vulnerabilities, such as those identified by OWASP, in the code and imported libraries. - Low cost: Static code analysis may be easily automated without the overhead of writing test cases, instrumenting the code, and program execution. - Coding standards compliance: Static analysis tools can analyze source syntax and enforce coding standards. - Better source code: Static code analysis tools can identify the unused code. Source: Cisco DEVCOR 350-901 Study Guide

Selected Answer: AB A and B are correct. Static code analysis complements dynamic testing to provide extra advantages: - Error detection: Static code analysis can identify hundreds of classes of bugs related to concurrency, tainted data, data flow, and static and dynamic memory. Some bugs are almost impossible to detect with dynamic testing. - Security vulnerabilities detection: Static code analysis can detect common vulnerabilities, such as those identified by OWASP, in the code and imported libraries. - Low cost: Static code analysis may be easily automated without the overhead of writing test cases, instrumenting the code, and program execution. - Coding standards compliance: Static analysis tools can analyze source syntax and enforce coding standards. - Better source code: Static code analysis tools can identify unused code.

The answers are B and D

I would go for A and B, as D sounds like it is too much related to the running code.

Selected Answer: AB I agree with Bloody_sausage and B3nd3cida.

Selected Answer: AB Correct answer: A & B

A and D

For me B is one of the answers but though choice between A and D. Tainted data where input is not checked is not being tested by unit testing and therefore is a benefit of SCA. On the other hand, race conditions are also possible to check on SCA.

it's very hard to determine race conditions by just looking at the code