Before promoting custom city code, the AppSec lead wants defects found without executing the program. Which testing approach belongs in the pipeline?
Select an answer to reveal the explanation.
Short Explanation
SAST is like proofreading the blueprints before you build the bridge—you catch cracks without driving trucks over it yet. Running it in the pipeline flags insecure patterns in custom city code early. That's cheaper than apologizing to citizens later.
Full Explanation
Static application security testing (SAST) analyzes source or bytecode without executing the program, which makes it ideal for pre-promotion pipelines on custom city code. SAST finds injection patterns, insecure API use, hard-coded credentials, and other defects early—when remediation is cheaper and before residents interact with flawed builds. Placing SAST in CI provides repeatable, automated assurance aligned with Domain 8 secure coding and testing expectations.
Relying only on production traffic mirroring with no pre-release analysis postpones discovery until live civic systems are exposed. Mirroring can support late-stage testing but is not a substitute for finding defects before promotion.
Relying solely on end-user bug reports after go-live outsources security discovery to residents and adversaries. Citizens should not be the primary SAST surrogate; reactive reports arrive after harm or embarrassment is possible.
Physical penetration of the data-center cage instead of code review addresses facility access, not application logic flaws. Cage testing is a physical-security activity; it does not inspect source for software weaknesses the AppSec lead asked to find without execution.
Exam caveat: distinguish SAST (non-executing code analysis) from DAST/IAST and from physical tests; exam stems that say without executing point to SAST. Operational check: fail builds on high-severity SAST findings for municipal apps, tune rules to reduce noise, track escaped defects, and combine SAST with SCA and later dynamic testing rather than treating any single method as complete.