Software Composition Analysis (SCA) is the best method for identifying all components, dependencies, and open-source libraries used in an application. It ensures that organizations track and manage vulnerabilities in third-party code before deployment.
SCA tools generate a Software Bill of Materials (SBOM), which provides a full representation of the code and modules used in the application.
Other options:
Static Application Security Testing (SAST) (C) checks for vulnerabilities but does not map dependencies.
Interactive Application Security Testing (IAST) (D) works at runtime, not before deployment.
Runtime Application Self-Protection (RASP) (B) works while the application is running.