For a semester exam, which option is correct about dynamic application security testing?

A. designing class diagrams B. writing policy documents only C. testing a running application for security weaknesses D. reading source code only