I and II are false statements about static analysis. Static analysis cannot be used instead of dynamic testing (I), as it cannot verify the behavior or performance of the system under test at runtime. Static analysis can uncover defects like security vulnerabilities (II), as it can detect potential weaknesses or flaws in the source code that may lead to security breaches. defines static analysis as follows:

Static analysis is a type of software testing that analyzes the source code or other software artifacts without executing them. Static analysis can be used to check conformance to specifications and standards, detect syntax and logical errors, measure complexity and quality metrics, identify code smells and bad practices, find potential security vulnerabilities, and improve maintainability and readability.

III and IV are true statements about static analysis. Static analysis can be used to check conformance to specifications and standards (III), as it can compare the source code or other software artifacts against predefined rules or criteria. Static analysis typically detects failures prior to component testing (IV), as it can be performed early in the development cycle before compiling or executing the code.