Question

A cloud-native software company is maturing its secure SDLC after several vulnerabilities reached production. The CISO wants to reduce the recurrence of insecure code by addressing the root cause rather than relying solely on downstream scanning. Which action most directly builds a durable, preventive security culture within the development teams?

Accepted Answer

Provide role-based secure coding and application security awareness training tailored to developers, architects, and QA

Answer

Deploy an additional runtime application self-protection (RASP) agent across all production workloads

Answer

Increase the frequency of automated DAST scans in the CI/CD pipeline to catch issues before release

Answer

Require a third-party penetration test before every major release to validate application security