Code review and testing: static, dynamic, fuzzing, misuse case, test coverage, interface testing

Software is where many vulnerabilities are born, so testing code is a core assessment activity in the Security Assessment and Testing domain. The exam expects you to know the major techniques, what kind of flaw each one finds, and where in the software development lifecycle (SDLC) each fits. No single technique catches everything. A mature program layers several of them so that the blind spots of one are covered by another, and it starts testing as early as possible, because a flaw found in design or code costs far less to fix than one found in production.