Which of the following tools is considered a web application scanner?

The correct answer is D. ZAP.

Explanation: ZAP (Zed Attack Proxy) is a web application security scanner that is specifically designed to find vulnerabilities in web applications. It helps developers and security professionals identify potential security issues during the development process. Nessus, Qualys, and OpenVAS are primarily used for network vulnerability scanning rather than specifically targeted at web applications.