Why does the municipal CI include a static-analysis job before Docker build and promote of the Webex ChatOps service?
Select an answer to reveal the explanation.
Short Explanation
Inspect the blueprints before the building ships—static analysis fails on known patterns while the code is still in CI, not after users trip over it in production logs.
Full Explanation
The municipal CI includes a static-analysis job before Docker build and promote of the Webex ChatOps service so source (or bytecode) is checked for named bug and security patterns before the image ships. Static analysis is an early, automated review of code structure and known anti-patterns while the artifact is still in the pipeline—cheaper than finding the same issues after promote.
It does not replace production log diagnosis as the only way bugs are ever found; runtime issues still need observability, but many defect classes are caught earlier in CI. Administering a commercial SAST SKU’s license console is not the exam skill—the skill is why analysis runs before ship. Teaching candidates how to weaponize XSS in a live exploit walkthrough is out of scope and opposite of a defensive quality gate.
Exam caveat: static analysis finds patterns in code before runtime; it complements tests and monitoring rather than replacing either, and no specific vendor console is required. Operational check: ensure the Webex ChatOps pipeline runs static analysis before image build/promote, review findings for named patterns, and keep promote blocked or flagged according to city policy when high-severity issues appear.