The correct option is Static code analysis.

Static code analysis examines source code and committed changes without running the application so it can provide fast, actionable feedback at the pull request stage. It is commonly integrated into pull request checks or CI pipelines so that issues such as insecure coding patterns, hardcoded secrets, and basic dataflow flaws can be detected before code is merged.

Threat modeling is a design and architecture activity that helps identify potential threats and mitigation strategies for a system. It is not an automated check that runs on each pull request and it focuses on system design rather than scanning the actual code changes.

Dynamic application security testing analyzes a running application and finds runtime and environment specific issues. It is typically performed later in the pipeline or against deployed test environments and it is not suitable for the quick, pre-merge feedback that is needed at the pull request stage.

Full AWS Practitioner Certification Question