Which statement correctly places static analysis for DEVCOR task 4.3 versus application security mitigations?
Select an answer to reveal the explanation.
Short Explanation
4.3 asks why the scanner sits on the assembly line—in CI—before the crate ships. How you harden the app against OWASP issues is a different station (4.10), not a live exploit demo.
Full Explanation
Task 4.3 asks why static analysis belongs in the pipeline as a CI control before promote. It does not ask candidates to weaponize XSS or to select a SAST SKU. Application-level OWASP mitigations are covered under a different task. Static analysis complements, rather than replaces, tests and quality gates.