The correct answer is B. Static.
Static analysis examines source code, bytecode, or application binaries without executing the application. It is commonly used to identify insecure coding practices, vulnerabilities, hardcoded secrets, weak cryptographic implementations, input validation issues, and misconfigurations before the application is deployed or run.
This aligns with CompTIA Security+ SY0-701 topics involving vulnerability discovery, secure application development, and security testing methods.
Why the other options are incorrect:
A. Dynamic
Dynamic analysis tests an application while it is running. It is used to observe runtime behavior, authentication issues, session handling problems, and active vulnerabilities during execution.
C. Gap
A gap analysis compares the current state against a desired standard, framework, or requirement. It is not specifically the review of source code.
D. Impact
Impact analysis evaluates the effect of a risk, change, incident, or vulnerability on the organization. It does not describe reviewing source code.
Therefore, reviewing source code without running the application is static analysis.
