The correct choice is (c) 2
Easy explanation: There are two ways to detect buffer-overflow in an application. One way is to look into the code and check whether the boundary check has been properly incorporated or not. The other way is to make the executable build of the product, feed the application with a huge amount of data and check for abnormal behaviour.