Question

A DevSecOps team is integrating automated security testing into a CI/CD pipeline for a customer-facing web application. Leadership wants defects caught as early as possible to reduce remediation cost, but also insists that runtime vulnerabilities involving authentication flows and server misconfiguration be detected before production release. The team must select where to place Static Application Security Testing (SAST), Software Composition Analysis (SCA), and Dynamic Application Security Testing (DAST). Which pipeline design best satisfies both requirements?

Accepted Answer

Run SAST and SCA during the commit/build stage against source and dependencies, then run DAST against a deployed build in a staging environment before the production gate

Answer

Run DAST at the commit stage against source code, defer SAST to staging, and run SCA only after production deployment during monitoring

Answer

Run all three tools (SAST, SCA, DAST) exclusively in production against live traffic to ensure realistic results

Answer

Run only SCA at build time and rely on manual penetration testing quarterly to cover both static and runtime defects