Question

A development team pushes code to production multiple times per day using an automated CI/CD pipeline. The security team is frequently discovering vulnerabilities only after release, forcing costly emergency patches. As the SecOps analyst, which SecDevOps recommendation best addresses the root cause and reduces late-stage remediation?

Accepted Answer

Integrate automated static application security testing (SAST) and dependency scanning into the build stage of the pipeline so vulnerabilities are caught before deployment

Answer

Schedule a quarterly manual penetration test against the production environment to catch issues after each release cycle

Answer

Require developers to submit code to the security team for manual review via email before every commit

Answer

Disable automated deployments entirely and revert to weekly change-approval board meetings for all releases