A team wants to identify vulnerable third-party libraries before releasing its container image. Which assessment is most relevant?

1. A traffic volume report without dependency inspection
2. Software composition analysis of the image's dependencies
3. A business impact assessment as the only technical test
4. A backup restoration exercise