A development team deploys code to production many times a day, and security testing currently happens only in a manual review before each quarterly audit. Which change BEST integrates security into this delivery process?
Select an answer to reveal the explanation.
Short Explanation
If your code ships several times a day, a security check that happens once a quarter is basically never. Build the tests into the CI/CD pipeline and every commit gets checked automatically before it goes out the door. An annual pentest is useful, but it's not keeping pace with this team - that's the trap.
Full Explanation
Continuous integration and continuous deployment (CI/CD) pipelines build, test, and release code automatically on every change. Integrating security tests into those pipeline stages, such as static analysis, dependency and secrets scanning, and dynamic tests in a staging environment, means each commit is evaluated before it can reach production, and builds can fail when serious findings appear. This matches security testing to the actual pace of delivery and gives developers feedback while the change is fresh. An annual penetration test provides valuable depth, but with many deployments a day it evaluates a version of the application that is replaced almost immediately, so it cannot gate releases. Weekly network vulnerability scans of production servers focus on host and service vulnerabilities and run after deployment, missing flaws in custom code before they ship. Self-review before quarterly audits is manual, inconsistent, and occurs far less often than code changes. Exam caveat: pipeline gates need tuning, because an overly noisy gate that blocks every build tends to be bypassed. Operational check: introduce a known test finding, such as a planted dummy secret, in a feature branch and confirm the pipeline fails the build and reports it before merge.