Static code analysis is correct because measuring defects per thousand lines of code is a source code quality metric that comes from automated analysis of code rather than from runtime testing or manual design exercises.

Static code analysis tools analyze source or compiled code without executing it and they produce quantitative metrics such as defects per KLOC, cyclomatic complexity, and code smells. These metrics are useful for tracking code quality across repositories and for feeding continuous integration pipelines.

Vulnerability scanning is incorrect because vulnerability scanners typically examine running systems, deployed applications, or binaries for known vulnerabilities and misconfigurations and they do not generally produce defects per thousand lines of source code as a core metric.

Code review is incorrect because code review is a human inspection process and while reviewers can count defects it is not the automated, codebase wide metric described in the question and it is not typically reported as defects per KLOC by tools.

Threat modeling is incorrect because threat modeling is a design phase activity that identifies potential attackers and attack paths and it does not produce line of code based defect density metrics.

Full AWS Practitioner Certification Question