The correct answer is A. Decompile the bytecode.

Java applications are commonly distributed as archive files such as .jar, .war, or .ear files. These archives usually contain compiled Java bytecode in .class files rather than the original readable source code.

To perform static analysis, the tester must inspect the application without executing it. Therefore, the first practical step is to extract and decompile the Java bytecode back into readable Java-like source code using tools such as JD-GUI, CFR, FernFlower, or JADX.

B is incorrect because fuzz testing is a dynamic testing technique. It involves sending malformed or unexpected inputs to a running application, not reviewing the application statically.

C is incorrect because a .so file is a Linux shared object library. Converting a Java archive to a .so file is not part of Java static analysis.

D is incorrect because the Java interpreter is part of the runtime environment. Disassembling the interpreter does not analyze the target Java application.

In PenTest+ terms, this falls under Tools and Code Analysis, specifically static application security testing, reverse engineering Java archives, and reviewing compiled bytecode for security flaws.

Moorche2026-04-29T01:08:00.59M