For a semester exam, which option is correct about static application security testing?

A. asking users for opinions B. analyzing source or binary code without running the program C. observing live network traffic only D. testing only in production